Edit tour

Windows Analysis Report
25XrVZw56S.exe

Overview

General Information

Sample name:	25XrVZw56S.exe renamed because original name is a hash value
Original sample name:	6ba07e3e540b3a47a2a136c0320e55b4ba6e388241e7408ebee798c92ae324d9.exe
Analysis ID:	1530008
MD5:	d2965931e5463a26443a022b95edf5d4
SHA1:	6bfde34ce3d9ef20f5265ff5045fd2411a9f3655
SHA256:	6ba07e3e540b3a47a2a136c0320e55b4ba6e388241e7408ebee798c92ae324d9
Tags:	exeuser-adrian__luca
Infos:

Detection

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

AI detected suspicious sample

Machine Learning detection for dropped file

Machine Learning detection for sample

Tries to resolve many domain names, but no domain seems valid

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Connects to many different domains

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to enumerate running services

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Executes massive DNS lookups (> 100)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

System is w10x64

25XrVZw56S.exe (PID: 7072 cmdline: "C:\Users\user\Desktop\25XrVZw56S.exe" MD5: D2965931E5463A26443A022B95EDF5D4)

mt2o4nrsazl5davsv.exe (PID: 7120 cmdline: "C:\bamqdjw\mt2o4nrsazl5davsv.exe" MD5: D2965931E5463A26443A022B95EDF5D4)

erewpegtq.exe (PID: 5932 cmdline: "C:\bamqdjw\erewpegtq.exe" MD5: D2965931E5463A26443A022B95EDF5D4)

conhost.exe (PID: 2688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

erewpegtq.exe (PID: 5772 cmdline: C:\bamqdjw\erewpegtq.exe MD5: D2965931E5463A26443A022B95EDF5D4)

czmruiag.exe (PID: 2200 cmdline: ulazkbbwltmi "c:\bamqdjw\erewpegtq.exe" MD5: D2965931E5463A26443A022B95EDF5D4)

erewpegtq.exe (PID: 600 cmdline: "c:\bamqdjw\erewpegtq.exe" MD5: D2965931E5463A26443A022B95EDF5D4)

czmruiag.exe (PID: 4296 cmdline: ulazkbbwltmi "c:\bamqdjw\erewpegtq.exe" MD5: D2965931E5463A26443A022B95EDF5D4)

cleanup

Suricata Signatures

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-09T16:27:22.078360+0200	2018141	1	A Network Trojan was detected	54.244.188.177	80	192.168.2.4	49730	TCP
2024-10-09T16:28:52.061806+0200	2018141	1	A Network Trojan was detected	34.218.204.173	80	192.168.2.4	50467	TCP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-09T16:27:22.078360+0200	2037771	1	A Network Trojan was detected	54.244.188.177	80	192.168.2.4	49730	TCP
2024-10-09T16:28:52.061806+0200	2037771	1	A Network Trojan was detected	34.218.204.173	80	192.168.2.4	50467	TCP

ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-09T16:27:22.372050+0200	2811542	1	A Network Trojan was detected	1.1.1.1	53	192.168.2.4	64469	UDP
2024-10-09T16:28:49.643108+0200	2811542	1	A Network Trojan was detected	1.1.1.1	53	192.168.2.4	52475	UDP

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-09T16:27:22.073475+0200	2815568	1	A Network Trojan was detected	192.168.2.4	49730	54.244.188.177	80	TCP
2024-10-09T16:28:39.802352+0200	2815568	1	A Network Trojan was detected	192.168.2.4	50397	54.244.188.177	80	TCP

ETPRO MALWARE W32/Bayrob Attempted Checkin 2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-09T16:27:22.073475+0200	2820680	1	Malware Command and Control Activity Detected	192.168.2.4	49730	54.244.188.177	80	TCP
2024-10-09T16:28:39.802352+0200	2820680	1	Malware Command and Control Activity Detected	192.168.2.4	50397	54.244.188.177	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 25XrVZw56S.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Avira: detection malicious, Label: HEUR/AGEN.1318777
Source: C:\bamqdjw\czmruiag.exe	Avira: detection malicious, Label: HEUR/AGEN.1318777
Source: C:\bamqdjw\erewpegtq.exe	Avira: detection malicious, Label: HEUR/AGEN.1318777

Multi AV Scanner detection for dropped file

Source: C:\bamqdjw\czmruiag.exe	ReversingLabs: Detection: 89%
Source: C:\bamqdjw\erewpegtq.exe	ReversingLabs: Detection: 89%
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	ReversingLabs: Detection: 89%

Multi AV Scanner detection for submitted file

Source: 25XrVZw56S.exe

ReversingLabs: Detection: 89%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.3% probability

Machine Learning detection for dropped file

Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Joe Sandbox ML: detected
Source: C:\bamqdjw\czmruiag.exe	Joe Sandbox ML: detected
Source: C:\bamqdjw\erewpegtq.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 25XrVZw56S.exe

Joe Sandbox ML: detected

Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00CE67C0 GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptGenRandom,_rand,_rand,_rand,_rand,	1_2_00CE67C0
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00D12AF4 _LocaleUpdate::_LocaleUpdate,__isleadbyte_l,CryptAcquireContextA,MultiByteToWideChar,CryptAcquireContextA,MultiByteToWideChar,	1_2_00D12AF4
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CA67C0 GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptGenRandom,_rand,_rand,_rand,_rand,	2_2_00CA67C0

Source: 25XrVZw56S.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 25XrVZw56S.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FC0E80 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,_memset,	0_2_00FC0E80
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FF1938 _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,GetDriveTypeW,_free,___loctotime32_t,_free,__fstat32,__close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	0_2_00FF1938
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FE2C21 _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,_IsRootUNCName,GetDriveTypeW,_free,___loctotime64_t,_free,__fstat64i32,__close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	0_2_00FE2C21
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00D11938 _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,GetDriveTypeW,_free,___loctotime32_t,_free,__fstat32,__close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	1_2_00D11938
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00D02C21 _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,_IsRootUNCName,GetDriveTypeW,_free,___loctotime64_t,_free,__fstat64i32,__close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	1_2_00D02C21
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00CE0E80 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,_memset,	1_2_00CE0E80
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CA0E80 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,_memset,	2_2_00CA0E80
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CD1938 _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,_IsRootUNCName,GetDriveTypeW,_free,___loctotime32_t,_free,__sopen_s,__fstat32,__close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	2_2_00CD1938
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CC2C21 _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,_IsRootUNCName,GetDriveTypeW,_free,___loctotime64_t,_free,__sopen_s,__fstat64i32,__close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	2_2_00CC2C21
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001B2C21 _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,_IsRootUNCName,GetDriveTypeW,_free,___loctotime64_t,_free,__fstat64i32,__close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	3_2_001B2C21
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001C1938 _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,_IsRootUNCName,GetDriveTypeW,_free,___loctotime32_t,_free,__fstat32,__close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	3_2_001C1938
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_00190E80 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,_memset,	3_2_00190E80
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001C2C21 _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,_IsRootUNCName,GetDriveTypeW,_free,___loctotime64_t,_free,__fstat64i32,__close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	9_2_001C2C21
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001D1938 _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,_IsRootUNCName,GetDriveTypeW,_free,___loctotime32_t,_free,__fstat32,__close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	9_2_001D1938
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001A0E80 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,_memset,	9_2_001A0E80

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2815568 - Severity 1 - ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort : 192.168.2.4:49730 -> 54.244.188.177:80
Source: Network traffic	Suricata IDS: 2820680 - Severity 1 - ETPRO MALWARE W32/Bayrob Attempted Checkin 2 : 192.168.2.4:49730 -> 54.244.188.177:80
Source: Network traffic	Suricata IDS: 2811542 - Severity 1 - ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net) : 1.1.1.1:53 -> 192.168.2.4:64469
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 54.244.188.177:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 54.244.188.177:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2815568 - Severity 1 - ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort : 192.168.2.4:50397 -> 54.244.188.177:80
Source: Network traffic	Suricata IDS: 2820680 - Severity 1 - ETPRO MALWARE W32/Bayrob Attempted Checkin 2 : 192.168.2.4:50397 -> 54.244.188.177:80
Source: Network traffic	Suricata IDS: 2811542 - Severity 1 - ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net) : 1.1.1.1:53 -> 192.168.2.4:52475
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 34.218.204.173:80 -> 192.168.2.4:50467
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 34.218.204.173:80 -> 192.168.2.4:50467

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: degreefurther.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavenbecome.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavybecome.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlebecome.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavyfurther.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variouscover.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pleasantgovern.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answerbecome.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavengovern.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardbecome.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returngovern.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavenenough.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ordernature.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultneedle.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwardbecome.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwardfurther.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassbecome.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answercompany.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassenough.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardneedle.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultgovern.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardgovern.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentleenough.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returncover.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: necessarycover.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: necessarynature.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavencover.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pleasantneedle.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: degreecompany.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leaderenough.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavyneedle.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: degreecover.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pleasantfurther.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavennature.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultcompany.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardcover.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leaderbecome.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavyenough.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ordercover.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassnature.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: requireenough.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardenough.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: requirenature.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlenature.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlefurther.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassneedle.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leadergovern.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavencompany.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlegovern.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultenough.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardcompany.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: orderenough.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: degreebecome.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: necessaryenough.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pleasantenough.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousenough.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: necessarycompany.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returnfurther.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pleasantbecome.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultfurther.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: necessarygovern.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glasscover.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: necessaryneedle.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: requirecompany.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavygovern.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassgovern.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavenfurther.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leadercover.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pleasantnature.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardfurther.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leaderneedle.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answerfurther.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: necessaryfurther.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: orderbecome.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassfurther.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavenneedle.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwardcover.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: requireneedle.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: orderfurther.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousgovern.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: requiregovern.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answerenough.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answerneedle.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousnature.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultnature.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardnature.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ordergovern.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: requirebecome.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answercover.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentleneedle.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousbecome.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: orderneedle.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultcover.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returnenough.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavycompany.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answergovern.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leaderfurther.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlecover.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leadernature.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultbecome.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousneedle.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returnnature.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pleasantcompany.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: requirecover.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavynature.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousfurther.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: necessarybecome.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: requirefurther.net replaycode: Name error (3)

Source: unknown

Network traffic detected: DNS query count 116

Source: global traffic

DNS traffic detected: number of DNS queries: 116

Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: returnneedle.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: forwardcompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: glasscompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: pleasantcover.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: returnneedle.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: forwardcompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: glasscompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: pleasantcover.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: returnneedle.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: forwardcompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: glasscompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: pleasantcover.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: ordercompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: returnneedle.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: forwardcompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: glasscompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: pleasantcover.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: ordercompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: leadercompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: returnneedle.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: forwardcompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: glasscompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: pleasantcover.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: ordercompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: leadercompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: heavycover.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: gentlecompany.net

Source: Joe Sandbox View	IP Address: 34.218.204.173 34.218.204.173
Source: Joe Sandbox View	IP Address: 210.157.78.4 210.157.78.4

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\25XrVZw56S.exe

Code function: 0_2_00FBA5B0 __snprintf,socket,setsockopt,gethostbyname,inet_ntoa,inet_addr,htons,connect,send,recv,closesocket,

0_2_00FBA5B0

Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: returnneedle.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: forwardcompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: glasscompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: pleasantcover.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: returnneedle.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: forwardcompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: glasscompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: pleasantcover.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: returnneedle.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: forwardcompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: glasscompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: pleasantcover.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: ordercompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: returnneedle.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: forwardcompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: glasscompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: pleasantcover.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: ordercompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: leadercompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: returnneedle.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: forwardcompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: glasscompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: pleasantcover.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: ordercompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: leadercompany.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: heavycover.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: gentlecompany.net

Source: global traffic	DNS traffic detected: DNS query: glassnature.net
Source: global traffic	DNS traffic detected: DNS query: answerneedle.net
Source: global traffic	DNS traffic detected: DNS query: glassneedle.net
Source: global traffic	DNS traffic detected: DNS query: answerenough.net
Source: global traffic	DNS traffic detected: DNS query: glassenough.net
Source: global traffic	DNS traffic detected: DNS query: answergovern.net
Source: global traffic	DNS traffic detected: DNS query: glassgovern.net
Source: global traffic	DNS traffic detected: DNS query: difficultnature.net
Source: global traffic	DNS traffic detected: DNS query: heardnature.net
Source: global traffic	DNS traffic detected: DNS query: difficultneedle.net
Source: global traffic	DNS traffic detected: DNS query: heardneedle.net
Source: global traffic	DNS traffic detected: DNS query: difficultenough.net
Source: global traffic	DNS traffic detected: DNS query: heardenough.net
Source: global traffic	DNS traffic detected: DNS query: difficultgovern.net
Source: global traffic	DNS traffic detected: DNS query: heardgovern.net
Source: global traffic	DNS traffic detected: DNS query: pleasantnature.net
Source: global traffic	DNS traffic detected: DNS query: necessarynature.net
Source: global traffic	DNS traffic detected: DNS query: pleasantneedle.net
Source: global traffic	DNS traffic detected: DNS query: necessaryneedle.net
Source: global traffic	DNS traffic detected: DNS query: pleasantenough.net
Source: global traffic	DNS traffic detected: DNS query: necessaryenough.net
Source: global traffic	DNS traffic detected: DNS query: pleasantgovern.net
Source: global traffic	DNS traffic detected: DNS query: necessarygovern.net
Source: global traffic	DNS traffic detected: DNS query: ordernature.net
Source: global traffic	DNS traffic detected: DNS query: requirenature.net
Source: global traffic	DNS traffic detected: DNS query: orderneedle.net
Source: global traffic	DNS traffic detected: DNS query: requireneedle.net
Source: global traffic	DNS traffic detected: DNS query: orderenough.net
Source: global traffic	DNS traffic detected: DNS query: requireenough.net
Source: global traffic	DNS traffic detected: DNS query: ordergovern.net
Source: global traffic	DNS traffic detected: DNS query: requiregovern.net
Source: global traffic	DNS traffic detected: DNS query: leadernature.net
Source: global traffic	DNS traffic detected: DNS query: heavennature.net
Source: global traffic	DNS traffic detected: DNS query: leaderneedle.net
Source: global traffic	DNS traffic detected: DNS query: heavenneedle.net
Source: global traffic	DNS traffic detected: DNS query: leaderenough.net
Source: global traffic	DNS traffic detected: DNS query: heavenenough.net
Source: global traffic	DNS traffic detected: DNS query: leadergovern.net
Source: global traffic	DNS traffic detected: DNS query: heavengovern.net
Source: global traffic	DNS traffic detected: DNS query: heavynature.net
Source: global traffic	DNS traffic detected: DNS query: gentlenature.net
Source: global traffic	DNS traffic detected: DNS query: heavyneedle.net
Source: global traffic	DNS traffic detected: DNS query: gentleneedle.net
Source: global traffic	DNS traffic detected: DNS query: heavyenough.net
Source: global traffic	DNS traffic detected: DNS query: gentleenough.net
Source: global traffic	DNS traffic detected: DNS query: heavygovern.net
Source: global traffic	DNS traffic detected: DNS query: gentlegovern.net
Source: global traffic	DNS traffic detected: DNS query: variousnature.net
Source: global traffic	DNS traffic detected: DNS query: returnnature.net
Source: global traffic	DNS traffic detected: DNS query: variousneedle.net
Source: global traffic	DNS traffic detected: DNS query: returnneedle.net
Source: global traffic	DNS traffic detected: DNS query: variousenough.net
Source: global traffic	DNS traffic detected: DNS query: returnenough.net
Source: global traffic	DNS traffic detected: DNS query: variousgovern.net
Source: global traffic	DNS traffic detected: DNS query: returngovern.net
Source: global traffic	DNS traffic detected: DNS query: degreefurther.net
Source: global traffic	DNS traffic detected: DNS query: forwardfurther.net
Source: global traffic	DNS traffic detected: DNS query: degreecover.net
Source: global traffic	DNS traffic detected: DNS query: forwardcover.net
Source: global traffic	DNS traffic detected: DNS query: degreebecome.net
Source: global traffic	DNS traffic detected: DNS query: forwardbecome.net
Source: global traffic	DNS traffic detected: DNS query: degreecompany.net
Source: global traffic	DNS traffic detected: DNS query: forwardcompany.net
Source: global traffic	DNS traffic detected: DNS query: answerfurther.net
Source: global traffic	DNS traffic detected: DNS query: glassfurther.net
Source: global traffic	DNS traffic detected: DNS query: answercover.net
Source: global traffic	DNS traffic detected: DNS query: glasscover.net
Source: global traffic	DNS traffic detected: DNS query: answerbecome.net
Source: global traffic	DNS traffic detected: DNS query: glassbecome.net
Source: global traffic	DNS traffic detected: DNS query: answercompany.net
Source: global traffic	DNS traffic detected: DNS query: glasscompany.net
Source: global traffic	DNS traffic detected: DNS query: difficultfurther.net
Source: global traffic	DNS traffic detected: DNS query: heardfurther.net
Source: global traffic	DNS traffic detected: DNS query: difficultcover.net
Source: global traffic	DNS traffic detected: DNS query: heardcover.net
Source: global traffic	DNS traffic detected: DNS query: difficultbecome.net
Source: global traffic	DNS traffic detected: DNS query: heardbecome.net
Source: global traffic	DNS traffic detected: DNS query: difficultcompany.net
Source: global traffic	DNS traffic detected: DNS query: heardcompany.net
Source: global traffic	DNS traffic detected: DNS query: pleasantfurther.net
Source: global traffic	DNS traffic detected: DNS query: necessaryfurther.net
Source: global traffic	DNS traffic detected: DNS query: pleasantcover.net
Source: global traffic	DNS traffic detected: DNS query: necessarycover.net
Source: global traffic	DNS traffic detected: DNS query: pleasantbecome.net
Source: global traffic	DNS traffic detected: DNS query: necessarybecome.net
Source: global traffic	DNS traffic detected: DNS query: pleasantcompany.net
Source: global traffic	DNS traffic detected: DNS query: necessarycompany.net
Source: global traffic	DNS traffic detected: DNS query: orderfurther.net
Source: global traffic	DNS traffic detected: DNS query: requirefurther.net
Source: global traffic	DNS traffic detected: DNS query: ordercover.net
Source: global traffic	DNS traffic detected: DNS query: requirecover.net
Source: global traffic	DNS traffic detected: DNS query: orderbecome.net
Source: global traffic	DNS traffic detected: DNS query: requirebecome.net
Source: global traffic	DNS traffic detected: DNS query: ordercompany.net
Source: global traffic	DNS traffic detected: DNS query: requirecompany.net
Source: global traffic	DNS traffic detected: DNS query: leaderfurther.net
Source: global traffic	DNS traffic detected: DNS query: heavenfurther.net
Source: global traffic	DNS traffic detected: DNS query: leadercover.net
Source: global traffic	DNS traffic detected: DNS query: heavencover.net
Source: global traffic	DNS traffic detected: DNS query: leaderbecome.net

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 14:28:55 GMTContent-Type: text/htmlContent-Length: 2814Connection: closeVary: Accept-EncodingLast-Modified: Thu, 22 Apr 2021 10:24:00 GMTETag: "afe-5c08d13eb1b03"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 45 55 43 2d 4a 50 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 58 53 45 52 56 45 52 20 49 6e 63 2e 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 4e 44 45 58 2c 46 4f 4c 4c 4f 57 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2a 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 7d 0a 69 6d 67 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 3a 20 30 3b 0a 7d 0a 75 6c 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 65 6d 3b 0a 7d 0a 68 74 6d 6c 20 7b 0a 20 20 20 20 6f 76 65 72 66 6c 6f 77 2d 79 3a 20 73 63 72 6f 6c 6c 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 33 62 37 39 62 37 3b 0a 7d 0a 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 a5 e1 a5 a4 a5 ea a5 aa 22 2c 20 4d 65 69 72 79 6f 2c 20 22 a3 cd a3 d3 20 a3 d0 a5 b4 a5 b7 a5 c3 a5 af 22 2c 20 22 4d 53 20 50 47 6f 74 68 69 63 22 2c 20 22 a5 d2 a5 e9 a5 ae a5 ce b3 d1 a5 b4 20 50 72 6f 20 57 33 22 2c 20 22 48 69 72 61 67 69 6e 6f 20 4b 61 6b 75 20 47 6f 74 68 69 63 20 50 72 6f 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 37 35 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 77 68 69 74 65 3b 0a 7d 0a 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 7d 0a 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 68 32 20 7b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 14:29:05 GMTContent-Type: text/htmlContent-Length: 2814Connection: closeVary: Accept-EncodingLast-Modified: Thu, 22 Apr 2021 10:24:00 GMTETag: "afe-5c08d13eb1b03"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 45 55 43 2d 4a 50 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 58 53 45 52 56 45 52 20 49 6e 63 2e 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 4e 44 45 58 2c 46 4f 4c 4c 4f 57 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2a 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 7d 0a 69 6d 67 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 3a 20 30 3b 0a 7d 0a 75 6c 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 65 6d 3b 0a 7d 0a 68 74 6d 6c 20 7b 0a 20 20 20 20 6f 76 65 72 66 6c 6f 77 2d 79 3a 20 73 63 72 6f 6c 6c 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 33 62 37 39 62 37 3b 0a 7d 0a 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 a5 e1 a5 a4 a5 ea a5 aa 22 2c 20 4d 65 69 72 79 6f 2c 20 22 a3 cd a3 d3 20 a3 d0 a5 b4 a5 b7 a5 c3 a5 af 22 2c 20 22 4d 53 20 50 47 6f 74 68 69 63 22 2c 20 22 a5 d2 a5 e9 a5 ae a5 ce b3 d1 a5 b4 20 50 72 6f 20 57 33 22 2c 20 22 48 69 72 61 67 69 6e 6f 20 4b 61 6b 75 20 47 6f 74 68 69 63 20 50 72 6f 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 37 35 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 77 68 69 74 65 3b 0a 7d 0a 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 7d 0a 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 68 32 20 7b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 14:29:05 GMTContent-Type: text/htmlContent-Length: 2814Connection: closeVary: Accept-EncodingLast-Modified: Thu, 22 Apr 2021 10:24:00 GMTETag: "afe-5c08d13eb1b03"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 45 55 43 2d 4a 50 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 58 53 45 52 56 45 52 20 49 6e 63 2e 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 4e 44 45 58 2c 46 4f 4c 4c 4f 57 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2a 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 7d 0a 69 6d 67 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 3a 20 30 3b 0a 7d 0a 75 6c 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 65 6d 3b 0a 7d 0a 68 74 6d 6c 20 7b 0a 20 20 20 20 6f 76 65 72 66 6c 6f 77 2d 79 3a 20 73 63 72 6f 6c 6c 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 33 62 37 39 62 37 3b 0a 7d 0a 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 a5 e1 a5 a4 a5 ea a5 aa 22 2c 20 4d 65 69 72 79 6f 2c 20 22 a3 cd a3 d3 20 a3 d0 a5 b4 a5 b7 a5 c3 a5 af 22 2c 20 22 4d 53 20 50 47 6f 74 68 69 63 22 2c 20 22 a5 d2 a5 e9 a5 ae a5 ce b3 d1 a5 b4 20 50 72 6f 20 57 33 22 2c 20 22 48 69 72 61 67 69 6e 6f 20 4b 61 6b 75 20 47 6f 74 68 69 63 20 50 72 6f 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 37 35 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 77 68 69 74 65 3b 0a 7d 0a 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 7d 0a 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 68 32 20 7b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 14:29:16 GMTContent-Type: text/htmlContent-Length: 2814Connection: closeVary: Accept-EncodingLast-Modified: Thu, 22 Apr 2021 10:24:00 GMTETag: "afe-5c08d13eb1b03"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 45 55 43 2d 4a 50 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 58 53 45 52 56 45 52 20 49 6e 63 2e 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 4e 44 45 58 2c 46 4f 4c 4c 4f 57 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2a 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 7d 0a 69 6d 67 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 3a 20 30 3b 0a 7d 0a 75 6c 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 65 6d 3b 0a 7d 0a 68 74 6d 6c 20 7b 0a 20 20 20 20 6f 76 65 72 66 6c 6f 77 2d 79 3a 20 73 63 72 6f 6c 6c 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 33 62 37 39 62 37 3b 0a 7d 0a 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 a5 e1 a5 a4 a5 ea a5 aa 22 2c 20 4d 65 69 72 79 6f 2c 20 22 a3 cd a3 d3 20 a3 d0 a5 b4 a5 b7 a5 c3 a5 af 22 2c 20 22 4d 53 20 50 47 6f 74 68 69 63 22 2c 20 22 a5 d2 a5 e9 a5 ae a5 ce b3 d1 a5 b4 20 50 72 6f 20 57 33 22 2c 20 22 48 69 72 61 67 69 6e 6f 20 4b 61 6b 75 20 47 6f 74 68 69 63 20 50 72 6f 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 37 35 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 77 68 69 74 65 3b 0a 7d 0a 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 7d 0a 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 68 32 20 7b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 09 Oct 2024 14:29:20 GMTContent-Type: text/htmlContent-Length: 7825Connection: closeVary: Accept-EncodingLast-Modified: Thu, 07 Mar 2019 09:08:00 GMTETag: "1e91-5837d7168cbbf"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 45 55 43 2d 4a 50 22 20 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 2a 20 7b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0d 0a 7d 0d 0a 69 6d 67 20 7b 0d 0a 20 20 20 20 62 6f 72 64 65 72 3a 20 30 3b 0d 0a 7d 0d 0a 75 6c 20 7b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 65 6d 3b 0d 0a 7d 0d 0a 68 74 6d 6c 20 7b 0d 0a 20 20 20 20 6f 76 65 72 66 6c 6f 77 2d 79 3a 20 73 63 72 6f 6c 6c 3b 0d 0a 7d 0d 0a 62 6f 64 79 20 7b 0d 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 a5 e1 a5 a4 a5 ea a5 aa 22 2c 20 4d 65 69 72 79 6f 2c 20 22 a3 cd a3 d3 20 a3 d0 a5 b4 a5 b7 a5 c3 a5 af 22 2c 20 22 4d 53 20 50 47 6f 74 68 69 63 22 2c 20 22 a5 d2 a5 e9 a5 ae a5 ce b3 d1 a5 b4 20 50 72 6f 20 57 33 22 2c 20 22 48 69 72 61 67 69 6e 6f 20 4b 61 6b 75 20 47 6f 74 68 69 63 20 50 72 6f 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0d 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 37 35 25 3b 0d 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 72 67 62 28 32 35 35 2c 20 31 34 33 2c 20 38 33 29 3b 0d 0a 7d 0d 0a 68 31 20 7b 0d 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 34 34 70 78 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0d 0a 7d 0d 0a 68 32 20 7b 0d 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0d 0a 7d 0d 0a 70 20 7b 0d 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0d 0a 7d 0d 0a 2e 65 78 70 6c 61 69 6e 20 7b 0d 0a 20 20 20 20 6c

Source: erewpegtq.exe, 00000008.00000002.2941723598.0000000001D7D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://gentlecompany.net/index.php
Source: erewpegtq.exe, 00000002.00000002.2455125863.00000000014AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com

Source: C:\Users\user\Desktop\25XrVZw56S.exe	File created: C:\Windows\bamqdjw\	Jump to behavior
Source: C:\Users\user\Desktop\25XrVZw56S.exe	File created: C:\Windows\bamqdjw\txadnumgtelp	Jump to behavior
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	File created: C:\Windows\bamqdjw\txadnumgtelp	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	File created: C:\Windows\bamqdjw\txadnumgtelp	Jump to behavior
Source: C:\bamqdjw\czmruiag.exe	File created: C:\Windows\bamqdjw\txadnumgtelp	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	File created: C:\Windows\bamqdjw\txadnumgtelp	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	File created: C:\Windows\bamqdjw\txadnumgtelp	Jump to behavior
Source: C:\bamqdjw\czmruiag.exe	File created: C:\Windows\bamqdjw\txadnumgtelp	Jump to behavior

Source: C:\Users\user\Desktop\25XrVZw56S.exe

File deleted: C:\Windows\bamqdjw\txadnumgtelp

Jump to behavior

Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FCE9C0	0_2_00FCE9C0
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FDC064	0_2_00FDC064
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_010031EA	0_2_010031EA
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FE51F3	0_2_00FE51F3
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FF61D5	0_2_00FF61D5
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_01005331	0_2_01005331
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FE4295	0_2_00FE4295
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FFC281	0_2_00FFC281
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FDA3DF	0_2_00FDA3DF
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FDC499	0_2_00FDC499
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FE6423	0_2_00FE6423
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FFD50F	0_2_00FFD50F
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FD9680	0_2_00FD9680
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FC9630	0_2_00FC9630
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FFC7F3	0_2_00FFC7F3
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FE37D0	0_2_00FE37D0
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FDB758	0_2_00FDB758
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_010016D0	0_2_010016D0
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FDC8CE	0_2_00FDC8CE
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FC98B9	0_2_00FC98B9
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FF4A13	0_2_00FF4A13
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FDBC4C	0_2_00FDBC4C
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FFBD16	0_2_00FFBD16
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FB3EE0	0_2_00FB3EE0
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FDFE90	0_2_00FDFE90
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00CEE9C0	1_2_00CEE9C0
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00CFC064	1_2_00CFC064
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00D161D5	1_2_00D161D5
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00D051F3	1_2_00D051F3
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00D231EA	1_2_00D231EA
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00D04295	1_2_00D04295
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00D1C281	1_2_00D1C281
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00CFA3DF	1_2_00CFA3DF
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00D25331	1_2_00D25331
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00CFC499	1_2_00CFC499
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00D06423	1_2_00D06423
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00D1D50F	1_2_00D1D50F
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00D216D0	1_2_00D216D0
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00CF9680	1_2_00CF9680
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00CE9630	1_2_00CE9630
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00D037D0	1_2_00D037D0
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00D097D3	1_2_00D097D3
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00D1C7F3	1_2_00D1C7F3
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00CFB758	1_2_00CFB758
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00CFC8CE	1_2_00CFC8CE
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00CE98B9	1_2_00CE98B9
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00D14A13	1_2_00D14A13
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00CFBC4C	1_2_00CFBC4C
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00D1BD16	1_2_00D1BD16
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00CD3EE0	1_2_00CD3EE0
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00CFFE90	1_2_00CFFE90
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CC4295	2_2_00CC4295
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CAE9C0	2_2_00CAE9C0
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CBC064	2_2_00CBC064
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CD61D5	2_2_00CD61D5
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CE31EA	2_2_00CE31EA
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CC51F3	2_2_00CC51F3
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CDC281	2_2_00CDC281
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CBA3DF	2_2_00CBA3DF
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CE5331	2_2_00CE5331
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CBC499	2_2_00CBC499
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CC6423	2_2_00CC6423
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CDD50F	2_2_00CDD50F
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CE16D0	2_2_00CE16D0
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CB9680	2_2_00CB9680
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CA9630	2_2_00CA9630
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CC37D0	2_2_00CC37D0
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CC97D3	2_2_00CC97D3
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CDC7F3	2_2_00CDC7F3
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CBB758	2_2_00CBB758
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CBC8CE	2_2_00CBC8CE
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CA98B9	2_2_00CA98B9
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CD4A13	2_2_00CD4A13
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CBBC4C	2_2_00CBBC4C
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CDBD16	2_2_00CDBD16
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00C93EE0	2_2_00C93EE0
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CBFE90	2_2_00CBFE90
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_0019E9C0	3_2_0019E9C0
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001AC064	3_2_001AC064
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001C61D5	3_2_001C61D5
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001B51F3	3_2_001B51F3
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001D31EA	3_2_001D31EA
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001B4295	3_2_001B4295
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001CC281	3_2_001CC281
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001D5331	3_2_001D5331
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001AA3DF	3_2_001AA3DF
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001B6423	3_2_001B6423
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001AC499	3_2_001AC499
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001CD50F	3_2_001CD50F
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_00199630	3_2_00199630
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001A9680	3_2_001A9680
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001D16D0	3_2_001D16D0
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001AB758	3_2_001AB758
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001B97D3	3_2_001B97D3
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001B37D0	3_2_001B37D0
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001CC7F3	3_2_001CC7F3
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001998B9	3_2_001998B9
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001AC8CE	3_2_001AC8CE
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001C4A13	3_2_001C4A13
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001ABC4C	3_2_001ABC4C
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001CBD16	3_2_001CBD16
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001AFE90	3_2_001AFE90
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_00183EE0	3_2_00183EE0
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001AE9C0	9_2_001AE9C0
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001BC064	9_2_001BC064
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001D61D5	9_2_001D61D5
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001C51F3	9_2_001C51F3
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001E31EA	9_2_001E31EA
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001C4295	9_2_001C4295
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001DC281	9_2_001DC281
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001E5331	9_2_001E5331
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001BA3DF	9_2_001BA3DF
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001C6423	9_2_001C6423
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001BC499	9_2_001BC499
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001DD50F	9_2_001DD50F
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001A9630	9_2_001A9630
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001B9680	9_2_001B9680
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001E16D0	9_2_001E16D0
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001BB758	9_2_001BB758
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001C37D0	9_2_001C37D0
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001C97D3	9_2_001C97D3
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001DC7F3	9_2_001DC7F3
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001A98B9	9_2_001A98B9
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001BC8CE	9_2_001BC8CE
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001D4A13	9_2_001D4A13
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001BBC4C	9_2_001BBC4C
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001DBD16	9_2_001DBD16
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001BFE90	9_2_001BFE90
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_00193EE0	9_2_00193EE0

Source: C:\bamqdjw\czmruiag.exe	Code function: String function: 001C0697 appears 42 times
Source: C:\bamqdjw\czmruiag.exe	Code function: String function: 001BFDF0 appears 62 times
Source: C:\bamqdjw\czmruiag.exe	Code function: String function: 001AFDF0 appears 62 times
Source: C:\bamqdjw\czmruiag.exe	Code function: String function: 001B0697 appears 42 times
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: String function: 00D00697 appears 42 times
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: String function: 00CFFDF0 appears 62 times
Source: C:\bamqdjw\erewpegtq.exe	Code function: String function: 00CC0697 appears 42 times
Source: C:\bamqdjw\erewpegtq.exe	Code function: String function: 00CBFDF0 appears 62 times
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: String function: 00FDFDF0 appears 62 times
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: String function: 00FE0697 appears 42 times

Source: 25XrVZw56S.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal96.troj.evad.winEXE@13/6@408/9

Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	0_2_00FC8DE0
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	1_2_00CE8DE0
Source: C:\bamqdjw\erewpegtq.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	2_2_00CA8DE0
Source: C:\bamqdjw\czmruiag.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	3_2_00198DE0
Source: C:\bamqdjw\czmruiag.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	9_2_001A8DE0

Source: C:\Users\user\Desktop\25XrVZw56S.exe

Code function: 0_2_00FC6030 CreateToolhelp32Snapshot,Process32First,__snprintf,CreateToolhelp32Snapshot,Module32First,CloseHandle,Process32Next,CloseHandle,

0_2_00FC6030

Source: C:\Users\user\Desktop\25XrVZw56S.exe

Code function: 0_2_00FCD5E0 StartServiceCtrlDispatcherA,

0_2_00FCD5E0

Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FCD5E0 StartServiceCtrlDispatcherA,	0_2_00FCD5E0
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00CED5E0 StartServiceCtrlDispatcherA,	1_2_00CED5E0
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CAD5E0 StartServiceCtrlDispatcherA,	2_2_00CAD5E0
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_0019D5E0 StartServiceCtrlDispatcherA,	3_2_0019D5E0
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001AD5E0 StartServiceCtrlDispatcherA,	9_2_001AD5E0

Source: C:\bamqdjw\czmruiag.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2688:120:WilError_03

Source: 25XrVZw56S.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\25XrVZw56S.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 25XrVZw56S.exe

ReversingLabs: Detection: 89%

Source: C:\Users\user\Desktop\25XrVZw56S.exe

File read: C:\Users\user\Desktop\25XrVZw56S.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\25XrVZw56S.exe "C:\Users\user\Desktop\25XrVZw56S.exe"
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Process created: C:\bamqdjw\mt2o4nrsazl5davsv.exe "C:\bamqdjw\mt2o4nrsazl5davsv.exe"
Source: unknown	Process created: C:\bamqdjw\erewpegtq.exe C:\bamqdjw\erewpegtq.exe
Source: C:\bamqdjw\erewpegtq.exe	Process created: C:\bamqdjw\czmruiag.exe ulazkbbwltmi "c:\bamqdjw\erewpegtq.exe"
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Process created: C:\bamqdjw\erewpegtq.exe "C:\bamqdjw\erewpegtq.exe"
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\bamqdjw\czmruiag.exe	Process created: C:\bamqdjw\erewpegtq.exe "c:\bamqdjw\erewpegtq.exe"
Source: C:\bamqdjw\erewpegtq.exe	Process created: C:\bamqdjw\czmruiag.exe ulazkbbwltmi "c:\bamqdjw\erewpegtq.exe"
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Process created: C:\bamqdjw\mt2o4nrsazl5davsv.exe "C:\bamqdjw\mt2o4nrsazl5davsv.exe"	Jump to behavior
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Process created: C:\bamqdjw\erewpegtq.exe "C:\bamqdjw\erewpegtq.exe"	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Process created: C:\bamqdjw\czmruiag.exe ulazkbbwltmi "c:\bamqdjw\erewpegtq.exe"	Jump to behavior
Source: C:\bamqdjw\czmruiag.exe	Process created: C:\bamqdjw\erewpegtq.exe "c:\bamqdjw\erewpegtq.exe"	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Process created: C:\bamqdjw\czmruiag.exe ulazkbbwltmi "c:\bamqdjw\erewpegtq.exe"	Jump to behavior

Source: C:\Users\user\Desktop\25XrVZw56S.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\bamqdjw\czmruiag.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: 25XrVZw56S.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\25XrVZw56S.exe

Code function: 0_2_00FCE9C0 _malloc,_memset,GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetEnvironmentVariableA,CreateMutexA,CreateMutexA,CreateMutexA,GetTickCount,__itow,GetCommandLineA,__stat32i64,Sleep,__stat32i64,Sleep,__stat32i64,GetModuleFileNameA,SetFileAttributesA,CopyFileA,SetFileAttributesA,SetFileAttributesA,Sleep,GetCommandLineA,GetModuleFileNameA,LoadLibraryA,GetProcAddress,MessageBoxA,WSAStartup,CloseHandle,SetFileAttributesA,CopyFileA,SetFileAttributesA,Sleep,Sleep,SetFileAttributesA,CopyFileA,SetFileAttributesA,__snprintf,_memset,_memset,CreateThread,Sleep,

0_2_00FCE9C0

Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FEA064 push edi; ret	0_2_00FEA068
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FEA189 push esi; ret	0_2_00FEA18D
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FDF3DF push ecx; ret	0_2_00FDF3F2
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FE88F2 push edi; ret	0_2_00FE88F4
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FE89FA push esi; ret	0_2_00FE8A0D
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FE8BE6 push esi; ret	0_2_00FE8BE8
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FE9B9F push edi; ret	0_2_00FE9BA5
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FE9B75 push esi; ret	0_2_00FE9B79
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FE8CCF push edi; ret	0_2_00FE8CD1
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FDFE35 push ecx; ret	0_2_00FDFE48
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00CFF3DF push ecx; ret	1_2_00CFF3F2
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00CFFE35 push ecx; ret	1_2_00CFFE48
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CBF3DF push ecx; ret	2_2_00CBF3F2
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CBFE35 push ecx; ret	2_2_00CBFE48
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001AF3DF push ecx; ret	3_2_001AF3F2
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001AFE35 push ecx; ret	3_2_001AFE48
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001BF3DF push ecx; ret	9_2_001BF3F2
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001BFE35 push ecx; ret	9_2_001BFE48

Source: C:\bamqdjw\erewpegtq.exe	File created: C:\bamqdjw\czmruiag.exe	Jump to dropped file
Source: C:\Users\user\Desktop\25XrVZw56S.exe	File created: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Jump to dropped file
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	File created: C:\bamqdjw\erewpegtq.exe	Jump to dropped file

Source: C:\Users\user\Desktop\25XrVZw56S.exe

Code function: 0_2_00FCD5E0 StartServiceCtrlDispatcherA,

0_2_00FCD5E0

Source: C:\Users\user\Desktop\25XrVZw56S.exe

0_2_00FCE9C0

Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,_malloc,EnumServicesStatusA,__snprintf,_free,CloseServiceHandle,	0_2_00FCC5C0
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,_malloc,EnumServicesStatusA,__snprintf,_free,CloseServiceHandle,	1_2_00CEC5C0
Source: C:\bamqdjw\erewpegtq.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,_malloc,EnumServicesStatusA,__snprintf,_free,CloseServiceHandle,	2_2_00CAC5C0
Source: C:\bamqdjw\czmruiag.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,_malloc,EnumServicesStatusA,__snprintf,_free,CloseServiceHandle,	3_2_0019C5C0
Source: C:\bamqdjw\czmruiag.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,_malloc,EnumServicesStatusA,__snprintf,_free,CloseServiceHandle,	9_2_001AC5C0

Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: GetProcessHeap,LoadLibraryA,GetProcAddress,FreeLibrary,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,FreeLibrary,		1_2_00CDE7A0
Source: C:\bamqdjw\erewpegtq.exe	Code function: GetProcessHeap,LoadLibraryA,GetProcAddress,FreeLibrary,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,FreeLibrary,		2_2_00C9E7A0

Source: C:\bamqdjw\czmruiag.exe	Window / User API: threadDelayed 861			Jump to behavior
Source: C:\bamqdjw\czmruiag.exe	Window / User API: threadDelayed 1090			Jump to behavior

Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Evaded block: after key decision	graph_1-32559
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Evaded block: after key decision	graph_1-32597
Source: C:\bamqdjw\erewpegtq.exe	Evaded block: after key decision	graph_2-32724

Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_1-33195
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_0-33341
Source: C:\bamqdjw\erewpegtq.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_2-33819
Source: C:\bamqdjw\czmruiag.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_3-32855

Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_1-31829
Source: C:\bamqdjw\czmruiag.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_3-31767
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_0-32337

Source: C:\bamqdjw\erewpegtq.exe TID: 6396	Thread sleep count: 320 > 30	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe TID: 6396	Thread sleep time: -711040s >= -30000s	Jump to behavior
Source: C:\bamqdjw\czmruiag.exe TID: 908	Thread sleep count: 861 > 30	Jump to behavior
Source: C:\bamqdjw\czmruiag.exe TID: 908	Thread sleep time: -861000s >= -30000s	Jump to behavior
Source: C:\bamqdjw\czmruiag.exe TID: 908	Thread sleep count: 1090 > 30	Jump to behavior
Source: C:\bamqdjw\czmruiag.exe TID: 908	Thread sleep time: -1090000s >= -30000s	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe TID: 1608	Thread sleep count: 327 > 30	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe TID: 1608	Thread sleep time: -16350000s >= -30000s	Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe TID: 1608	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\bamqdjw\czmruiag.exe TID: 5676	Thread sleep count: 49 > 30	Jump to behavior
Source: C:\bamqdjw\czmruiag.exe TID: 5676	Thread sleep time: -49000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\bamqdjw\erewpegtq.exe	Last function: Thread delayed
Source: C:\bamqdjw\erewpegtq.exe	Last function: Thread delayed
Source: C:\bamqdjw\czmruiag.exe	Last function: Thread delayed
Source: C:\bamqdjw\czmruiag.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FB7DE0 GetSystemTime followed by cmp: cmp dword ptr [ebp-08h], 15h and CTI: jnl 00FB7E94h	0_2_00FB7DE0
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00CD7DE0 GetSystemTime followed by cmp: cmp dword ptr [ebp-08h], 15h and CTI: jnl 00CD7E94h	1_2_00CD7DE0
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00C97DE0 GetSystemTime followed by cmp: cmp dword ptr [ebp-08h], 15h and CTI: jnl 00C97E94h	2_2_00C97DE0
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_00187DE0 GetSystemTime followed by cmp: cmp dword ptr [ebp-08h], 15h and CTI: jnl 00187E94h	3_2_00187DE0
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_00197DE0 GetSystemTime followed by cmp: cmp dword ptr [ebp-08h], 15h and CTI: jnl 00197E94h	9_2_00197DE0

Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FC0E80 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,_memset,	0_2_00FC0E80
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FF1938 _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,GetDriveTypeW,_free,___loctotime32_t,_free,__fstat32,__close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	0_2_00FF1938
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FE2C21 _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,_IsRootUNCName,GetDriveTypeW,_free,___loctotime64_t,_free,__fstat64i32,__close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	0_2_00FE2C21
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00D11938 _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,GetDriveTypeW,_free,___loctotime32_t,_free,__fstat32,__close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	1_2_00D11938
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00D02C21 _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,_IsRootUNCName,GetDriveTypeW,_free,___loctotime64_t,_free,__fstat64i32,__close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	1_2_00D02C21
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00CE0E80 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,_memset,	1_2_00CE0E80
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CA0E80 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,_memset,	2_2_00CA0E80
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CD1938 _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,_IsRootUNCName,GetDriveTypeW,_free,___loctotime32_t,_free,__sopen_s,__fstat32,__close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	2_2_00CD1938
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CC2C21 _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,_IsRootUNCName,GetDriveTypeW,_free,___loctotime64_t,_free,__sopen_s,__fstat64i32,__close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	2_2_00CC2C21
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001B2C21 _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,_IsRootUNCName,GetDriveTypeW,_free,___loctotime64_t,_free,__fstat64i32,__close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	3_2_001B2C21
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001C1938 _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,_IsRootUNCName,GetDriveTypeW,_free,___loctotime32_t,_free,__fstat32,__close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	3_2_001C1938
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_00190E80 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,_memset,	3_2_00190E80
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001C2C21 _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,_IsRootUNCName,GetDriveTypeW,_free,___loctotime64_t,_free,__fstat64i32,__close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime64_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	9_2_001C2C21
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001D1938 _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,_IsRootUNCName,GetDriveTypeW,_free,___loctotime32_t,_free,__fstat32,__close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,___loctotime32_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,GetLastError,__dosmaperr,FindClose,	9_2_001D1938
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001A0E80 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,_memset,	9_2_001A0E80

Source: C:\bamqdjw\erewpegtq.exe	Thread delayed: delay time: 50000			Jump to behavior
Source: C:\bamqdjw\erewpegtq.exe	Thread delayed: delay time: 50000			Jump to behavior

Source: mt2o4nrsazl5davsv.exe, 00000001.00000002.1704922696.0000000000A2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll<
Source: erewpegtq.exe, 00000008.00000002.2941268951.000000000138D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllWW'
Source: erewpegtq.exe, 00000002.00000002.2455125863.00000000014AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlld

Source: C:\Users\user\Desktop\25XrVZw56S.exe	API call chain: ExitProcess graph end node	graph_0-32338
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	API call chain: ExitProcess graph end node	graph_1-31830
Source: C:\bamqdjw\erewpegtq.exe	API call chain: ExitProcess graph end node	graph_2-32020
Source: C:\bamqdjw\czmruiag.exe	API call chain: ExitProcess graph end node	graph_3-31768
Source: C:\bamqdjw\czmruiag.exe	API call chain: ExitProcess graph end node

Source: C:\bamqdjw\erewpegtq.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\25XrVZw56S.exe

Code function: 0_2_00FE02E8 _memset,IsDebuggerPresent,

0_2_00FE02E8

Source: C:\Users\user\Desktop\25XrVZw56S.exe

Code function: 0_2_00FEE432 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00FEE432

Source: C:\Users\user\Desktop\25XrVZw56S.exe

0_2_00FCE9C0

Source: C:\Users\user\Desktop\25XrVZw56S.exe

Code function: 0_2_00FBE7A0 GetProcessHeap,LoadLibraryA,GetProcAddress,FreeLibrary,HeapAlloc,FreeLibrary,HeapFree,HeapAlloc,FreeLibrary,HeapFree,FreeLibrary,

0_2_00FBE7A0

Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FE0CDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00FE0CDC
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: 0_2_00FE0CAB SetUnhandledExceptionFilter,	0_2_00FE0CAB
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00D00CDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00D00CDC
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: 1_2_00D00CAB SetUnhandledExceptionFilter,	1_2_00D00CAB
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CC0CDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00CC0CDC
Source: C:\bamqdjw\erewpegtq.exe	Code function: 2_2_00CC0CAB SetUnhandledExceptionFilter,	2_2_00CC0CAB
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001B0CAB SetUnhandledExceptionFilter,	3_2_001B0CAB
Source: C:\bamqdjw\czmruiag.exe	Code function: 3_2_001B0CDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_001B0CDC
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001C0CAB SetUnhandledExceptionFilter,	9_2_001C0CAB
Source: C:\bamqdjw\czmruiag.exe	Code function: 9_2_001C0CDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_001C0CDC

Source: C:\Users\user\Desktop\25XrVZw56S.exe

Code function: 0_2_00FBA200 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00FBA200

Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	0_2_00FFE784
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: EnumSystemLocalesW,	0_2_00FFE9F8
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: IsProcessorFeaturePresent,___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,	0_2_00FDF99D
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	0_2_00FFEAD1
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	0_2_00FFEA54
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	0_2_00FFEB54
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	0_2_00FFED49
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_00FEDD22
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00FFEE73
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	0_2_00FFEFF4
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: GetLocaleInfoW,	0_2_00FEDF89
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	0_2_00FFEF20
Source: C:\Users\user\Desktop\25XrVZw56S.exe	Code function: EnumSystemLocalesW,	0_2_00FEDF03
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	1_2_00D1E784
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,	1_2_00CFF9CE
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: EnumSystemLocalesW,	1_2_00D1E9F8
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	1_2_00D1EAD1
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	1_2_00D1EA54
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	1_2_00D1EB54
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	1_2_00D1ED49
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	1_2_00D0DD22
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_00D1EE73
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	1_2_00D1EFF4
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: GetLocaleInfoW,	1_2_00D0DF89
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: EnumSystemLocalesW,	1_2_00D0DF03
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	1_2_00D1EF20
Source: C:\bamqdjw\erewpegtq.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	2_2_00CDE784
Source: C:\bamqdjw\erewpegtq.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,	2_2_00CBF9CE
Source: C:\bamqdjw\erewpegtq.exe	Code function: EnumSystemLocalesW,	2_2_00CDE9F8
Source: C:\bamqdjw\erewpegtq.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	2_2_00CDEAD1
Source: C:\bamqdjw\erewpegtq.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	2_2_00CDEA54
Source: C:\bamqdjw\erewpegtq.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	2_2_00CDEB54
Source: C:\bamqdjw\erewpegtq.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	2_2_00CDED49
Source: C:\bamqdjw\erewpegtq.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	2_2_00CCDD22
Source: C:\bamqdjw\erewpegtq.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_00CDEE73
Source: C:\bamqdjw\erewpegtq.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	2_2_00CDEFF4
Source: C:\bamqdjw\erewpegtq.exe	Code function: GetLocaleInfoW,	2_2_00CCDF89
Source: C:\bamqdjw\erewpegtq.exe	Code function: EnumSystemLocalesW,	2_2_00CCDF03
Source: C:\bamqdjw\erewpegtq.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	2_2_00CDEF20
Source: C:\bamqdjw\czmruiag.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	3_2_001CE784
Source: C:\bamqdjw\czmruiag.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,	3_2_001AF9CE
Source: C:\bamqdjw\czmruiag.exe	Code function: EnumSystemLocalesW,	3_2_001CE9F8
Source: C:\bamqdjw\czmruiag.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	3_2_001CEA54
Source: C:\bamqdjw\czmruiag.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	3_2_001CEAD1
Source: C:\bamqdjw\czmruiag.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	3_2_001CEB54
Source: C:\bamqdjw\czmruiag.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	3_2_001BDD22
Source: C:\bamqdjw\czmruiag.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	3_2_001CED49
Source: C:\bamqdjw\czmruiag.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_001CEE73
Source: C:\bamqdjw\czmruiag.exe	Code function: EnumSystemLocalesW,	3_2_001BDF03
Source: C:\bamqdjw\czmruiag.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	3_2_001CEF20
Source: C:\bamqdjw\czmruiag.exe	Code function: GetLocaleInfoW,	3_2_001BDF89
Source: C:\bamqdjw\czmruiag.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	3_2_001CEFF4
Source: C:\bamqdjw\czmruiag.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	9_2_001DE784
Source: C:\bamqdjw\czmruiag.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,	9_2_001BF9CE
Source: C:\bamqdjw\czmruiag.exe	Code function: EnumSystemLocalesW,	9_2_001DE9F8
Source: C:\bamqdjw\czmruiag.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	9_2_001DEA54
Source: C:\bamqdjw\czmruiag.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	9_2_001DEAD1
Source: C:\bamqdjw\czmruiag.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	9_2_001DEB54
Source: C:\bamqdjw\czmruiag.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	9_2_001CDD22
Source: C:\bamqdjw\czmruiag.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	9_2_001DED49
Source: C:\bamqdjw\czmruiag.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_001DEE73
Source: C:\bamqdjw\czmruiag.exe	Code function: EnumSystemLocalesW,	9_2_001CDF03
Source: C:\bamqdjw\czmruiag.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	9_2_001DEF20
Source: C:\bamqdjw\czmruiag.exe	Code function: GetLocaleInfoW,	9_2_001CDF89
Source: C:\bamqdjw\czmruiag.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	9_2_001DEFF4

Source: C:\Users\user\Desktop\25XrVZw56S.exe

Code function: 0_2_00FEC365 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00FEC365

Source: C:\Users\user\Desktop\25XrVZw56S.exe

Code function: 0_2_00FFF713 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00FFF713

Source: C:\Users\user\Desktop\25XrVZw56S.exe

Code function: 0_2_00FCACD0 GetVersionExA,CreateDirectoryA,DeleteFileA,RemoveDirectoryA,CreateDirectoryA,CreateDirectoryA,__snprintf,__snprintf,CreateDirectoryA,CreateDirectoryA,GetTempPathA,CreateDirectoryA,GetTempPathA,SetFileAttributesA,_memset,

0_2_00FCACD0

Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\bamqdjw\mt2o4nrsazl5davsv.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	4 Windows Service	4 Windows Service	1 Masquerading	OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Service Execution	1 DLL Side-Loading	1 Process Injection	11 Virtualization/Sandbox Evasion	LSASS Memory	141 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	4 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	4 Native API	Logon Script (Windows)	1 DLL Side-Loading	1 Process Injection	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Service Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	14 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
25XrVZw56S.exe	89%	ReversingLabs	Win32.Spyware.Nivdort
25XrVZw56S.exe	100%	Avira	HEUR/AGEN.1318777
25XrVZw56S.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\bamqdjw\mt2o4nrsazl5davsv.exe	100%	Avira	HEUR/AGEN.1318777
C:\bamqdjw\czmruiag.exe	100%	Avira	HEUR/AGEN.1318777
C:\bamqdjw\erewpegtq.exe	100%	Avira	HEUR/AGEN.1318777
C:\bamqdjw\mt2o4nrsazl5davsv.exe	100%	Joe Sandbox ML
C:\bamqdjw\czmruiag.exe	100%	Joe Sandbox ML
C:\bamqdjw\erewpegtq.exe	100%	Joe Sandbox ML
C:\bamqdjw\czmruiag.exe	89%	ReversingLabs	Win32.Spyware.Nivdort
C:\bamqdjw\erewpegtq.exe	89%	ReversingLabs	Win32.Spyware.Nivdort
C:\bamqdjw\mt2o4nrsazl5davsv.exe	89%	ReversingLabs	Win32.Spyware.Nivdort

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
returnneedle.net	54.244.188.177	true	true	unknown
7450.bodis.com	199.59.243.227	true	false	unknown
heavycover.net	162.43.112.11	true	false	unknown
forwardcompany.net	34.218.204.173	true	true	unknown
hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com	52.71.57.184	true	false	unknown
gentlecompany.net	103.169.142.0	true	false	unknown
leadercompany.net	185.111.247.38	true	false	unknown
ordercompany.net	210.157.78.4	true	false	unknown
gentlegovern.net	unknown	unknown	true	unknown
variouscover.net	unknown	unknown	true	unknown
leaderneedle.net	unknown	unknown	true	unknown
leadercover.net	unknown	unknown	true	unknown
heavyfurther.net	unknown	unknown	true	unknown
forwardbecome.net	unknown	unknown	true	unknown
requireenough.net	unknown	unknown	true	unknown
answergovern.net	unknown	unknown	true	unknown
answercompany.net	unknown	unknown	true	unknown
orderfurther.net	unknown	unknown	true	unknown
gentlecover.net	unknown	unknown	true	unknown
difficultneedle.net	unknown	unknown	true	unknown
pleasantfurther.net	unknown	unknown	true	unknown
heavybecome.net	unknown	unknown	true	unknown
leaderfurther.net	unknown	unknown	true	unknown
heavenenough.net	unknown	unknown	true	unknown
heavenbecome.net	unknown	unknown	true	unknown
necessaryneedle.net	unknown	unknown	true	unknown
forwardfurther.net	unknown	unknown	true	unknown
pleasantcover.net	unknown	unknown	true	unknown
requireneedle.net	unknown	unknown	true	unknown
difficultenough.net	unknown	unknown	true	unknown
glasscompany.net	unknown	unknown	true	unknown
heavencompany.net	unknown	unknown	true	unknown
heardnature.net	unknown	unknown	true	unknown
heavyenough.net	unknown	unknown	true	unknown
requirefurther.net	unknown	unknown	true	unknown
glassgovern.net	unknown	unknown	true	unknown
difficultcompany.net	unknown	unknown	true	unknown
returnnature.net	unknown	unknown	true	unknown
gentlenature.net	unknown	unknown	true	unknown
necessaryfurther.net	unknown	unknown	true	unknown
pleasantbecome.net	unknown	unknown	true	unknown
degreecompany.net	unknown	unknown	true	unknown
requirebecome.net	unknown	unknown	true	unknown
necessarybecome.net	unknown	unknown	true	unknown
orderenough.net	unknown	unknown	true	unknown
necessarygovern.net	unknown	unknown	true	unknown
glassenough.net	unknown	unknown	true	unknown
pleasantneedle.net	unknown	unknown	true	unknown
gentleneedle.net	unknown	unknown	true	unknown
ordernature.net	unknown	unknown	true	unknown
heavyneedle.net	unknown	unknown	true	unknown
leaderbecome.net	unknown	unknown	true	unknown
answercover.net	unknown	unknown	true	unknown
pleasantnature.net	unknown	unknown	true	unknown
returnenough.net	unknown	unknown	true	unknown
heavycompany.net	unknown	unknown	true	unknown
heardenough.net	unknown	unknown	true	unknown
requiregovern.net	unknown	unknown	true	unknown
pleasantcompany.net	unknown	unknown	true	unknown
orderbecome.net	unknown	unknown	true	unknown
gentlefurther.net	unknown	unknown	true	unknown
pleasantenough.net	unknown	unknown	true	unknown
forwardcover.net	unknown	unknown	true	unknown
necessaryenough.net	unknown	unknown	true	unknown
heardneedle.net	unknown	unknown	true	unknown
glassneedle.net	unknown	unknown	true	unknown
heavygovern.net	unknown	unknown	true	unknown
necessarycover.net	unknown	unknown	true	unknown
difficultnature.net	unknown	unknown	true	unknown
pleasantgovern.net	unknown	unknown	true	unknown
variousenough.net	unknown	unknown	true	unknown
variousbecome.net	unknown	unknown	true	unknown
answerenough.net	unknown	unknown	true	unknown
requirecompany.net	unknown	unknown	true	unknown
heardcompany.net	unknown	unknown	true	unknown
difficultcover.net	unknown	unknown	true	unknown
glasscover.net	unknown	unknown	true	unknown
requirenature.net	unknown	unknown	true	unknown
gentleenough.net	unknown	unknown	true	unknown
gentlebecome.net	unknown	unknown	true	unknown
ordergovern.net	unknown	unknown	true	unknown
answerbecome.net	unknown	unknown	true	unknown
necessarynature.net	unknown	unknown	true	unknown
ordercover.net	unknown	unknown	true	unknown
answerfurther.net	unknown	unknown	true	unknown
glassnature.net	unknown	unknown	true	unknown
variousneedle.net	unknown	unknown	true	unknown
returncover.net	unknown	unknown	true	unknown
degreefurther.net	unknown	unknown	true	unknown
difficultgovern.net	unknown	unknown	true	unknown
leadernature.net	unknown	unknown	true	unknown
glassfurther.net	unknown	unknown	true	unknown
answerneedle.net	unknown	unknown	true	unknown
degreecover.net	unknown	unknown	true	unknown
heardgovern.net	unknown	unknown	true	unknown
heavennature.net	unknown	unknown	true	unknown
heavenfurther.net	unknown	unknown	true	unknown
returnfurther.net	unknown	unknown	true	unknown
difficultfurther.net	unknown	unknown	true	unknown
necessarycompany.net	unknown	unknown	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com	erewpegtq.exe, 00000002.00000002.2455125863.00000000014AA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://gentlecompany.net/index.php	erewpegtq.exe, 00000008.00000002.2941723598.0000000001D7D000.00000004.00000010.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.218.204.173	forwardcompany.net	United States	16509	AMAZON-02US	true
210.157.78.4	ordercompany.net	Japan	2510	INFOWEBFUJITSULIMITEDJP	false
103.169.142.0	gentlecompany.net	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
54.244.188.177	returnneedle.net	United States	16509	AMAZON-02US	true
199.59.243.227	7450.bodis.com	United States	395082	BODIS-NJUS	false
162.43.112.11	heavycover.net	United States	11333	CYBERTRAILSUS	false
52.71.57.184	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com	United States	14618	AMAZON-AESUS	false
54.209.32.212	unknown	United States	14618	AMAZON-AESUS	false
185.111.247.38	leadercompany.net	Turkey	209711	MUVHOSTTR	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1530008
Start date and time:	2024-10-09 16:26:24 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	25XrVZw56S.exe renamed because original name is a hash value
Original Sample Name:	6ba07e3e540b3a47a2a136c0320e55b4ba6e388241e7408ebee798c92ae324d9.exe
Detection:	MAL
Classification:	mal96.troj.evad.winEXE@13/6@408/9
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 64 Number of non-executed functions: 140
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: 25XrVZw56S.exe

Simulations

Behavior and APIs

Time	Type	Description
10:27:50	API Interceptor	1938x Sleep call for process: czmruiag.exe modified
10:27:58	API Interceptor	763x Sleep call for process: erewpegtq.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.218.204.173	oUc5lyEzJy.exe	Get hash	malicious	Unknown	Browse	forwardcompany.net/index.php
	JUHGSyleu7.exe	Get hash	malicious	Unknown	Browse	forwardcompany.net/index.php
	oUc5lyEzJy.exe	Get hash	malicious	Unknown	Browse	forwardcompany.net/index.php
	JUHGSyleu7.exe	Get hash	malicious	Unknown	Browse	forwardcompany.net/index.php
	4wwi2Lh5W4.exe	Get hash	malicious	Unknown	Browse	forwardcompany.net/index.php
	4wwi2Lh5W4.exe	Get hash	malicious	Unknown	Browse	forwardcompany.net/index.php
	LisectAVT_2403002B_290.exe	Get hash	malicious	Bdaejec	Browse	eiifngjfksisiufjf.biz/tldr.php?newinf=1
	Bn0VHqJWSS.exe	Get hash	malicious	Unknown	Browse	eveningbecome.net/index.php
	gZVfHNoTGQ.exe	Get hash	malicious	Unknown	Browse	eveningbecome.net/index.php
	Bn0VHqJWSS.exe	Get hash	malicious	Unknown	Browse	eveningbecome.net/index.php
210.157.78.4	oUc5lyEzJy.exe	Get hash	malicious	Unknown	Browse	ordercompany.net/index.php
	JUHGSyleu7.exe	Get hash	malicious	Unknown	Browse	ordercompany.net/index.php
	oUc5lyEzJy.exe	Get hash	malicious	Unknown	Browse	ordercompany.net/index.php
	JUHGSyleu7.exe	Get hash	malicious	Unknown	Browse	ordercompany.net/index.php
	4wwi2Lh5W4.exe	Get hash	malicious	Unknown	Browse	ordercompany.net/index.php
	4wwi2Lh5W4.exe	Get hash	malicious	Unknown	Browse	ordercompany.net/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
returnneedle.net	oUc5lyEzJy.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	JUHGSyleu7.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	oUc5lyEzJy.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	JUHGSyleu7.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	4wwi2Lh5W4.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	4wwi2Lh5W4.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
7450.bodis.com	oUc5lyEzJy.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	JUHGSyleu7.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	oUc5lyEzJy.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	JUHGSyleu7.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	4wwi2Lh5W4.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	4wwi2Lh5W4.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	https://pokerfanboy.com/	Get hash	malicious	Unknown	Browse	199.59.243.227
	https://mx1.margarettaphilomena.net/	Get hash	malicious	Unknown	Browse	199.59.243.227
	nBjauMrrmC.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
forwardcompany.net	oUc5lyEzJy.exe	Get hash	malicious	Unknown	Browse	34.218.204.173
	JUHGSyleu7.exe	Get hash	malicious	Unknown	Browse	34.218.204.173
	oUc5lyEzJy.exe	Get hash	malicious	Unknown	Browse	34.218.204.173
	JUHGSyleu7.exe	Get hash	malicious	Unknown	Browse	34.218.204.173
	4wwi2Lh5W4.exe	Get hash	malicious	Unknown	Browse	34.218.204.173
	4wwi2Lh5W4.exe	Get hash	malicious	Unknown	Browse	34.218.204.173
heavycover.net	oUc5lyEzJy.exe	Get hash	malicious	Unknown	Browse	162.43.112.11
	JUHGSyleu7.exe	Get hash	malicious	Unknown	Browse	162.43.112.11
	oUc5lyEzJy.exe	Get hash	malicious	Unknown	Browse	162.43.112.11
	JUHGSyleu7.exe	Get hash	malicious	Unknown	Browse	162.43.112.11
	4wwi2Lh5W4.exe	Get hash	malicious	Unknown	Browse	162.43.112.11
	4wwi2Lh5W4.exe	Get hash	malicious	Unknown	Browse	162.43.112.11
hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com	JUHGSyleu7.exe	Get hash	malicious	Unknown	Browse	52.71.57.184
	fp86koPm8O.exe	Get hash	malicious	Unknown	Browse	52.71.57.184
	firmware.i586.elf	Get hash	malicious	Unknown	Browse	52.71.57.184
	play.exe	Get hash	malicious	FormBook	Browse	52.71.57.184
	http://finde-mich-hier.pages.dev/	Get hash	malicious	Unknown	Browse	54.209.32.212
	bSecDbrnMO4yqnP.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	52.71.57.184
	FXja4SyAYs.exe	Get hash	malicious	Unknown	Browse	54.209.32.212
	Jla3M8Fe16.exe	Get hash	malicious	Unknown	Browse	52.71.57.184
	uTorrent.exe	Get hash	malicious	Unknown	Browse	52.71.57.184
	KY9D34Qh8d.exe	Get hash	malicious	Unknown	Browse	52.71.57.184

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	https://travelofarecom.wordpress.com/	Get hash	malicious	HTMLPhisher	Browse	3.254.33.149
	http://email.mx02.email-max.com/c/eJw8zrFy8iAAAOCnge33EEjAgcE_LVFrvcb0Wu3iQQDDBaLGxIt9-p4dOn_LZ0Q1m6HKQiumDHPKKCMM1kI7rozj1BnmEj5DjjuiqCOGpJozXkEvkjSdpoQiQFEc0XRio_LhX1TjpDpFGETd92dA5gBLgOWptcG3jTcPBFj2AEuaFV_LN7Tf7-7_E7QaLx3Khxw1K71E-e6pxgnA8naZl8-fi_O2zV77fN583DZDuZZZua1d-b3JYlduxvXw0haq6oti8d55GeyoOt_CeD9Ee72qoz148_eFnVDa2OCDqidKm9PQaEDR8dH_rd8E_gkAAP__7g5YOw	Get hash	malicious	Phisher	Browse	18.239.83.18
	oUc5lyEzJy.exe	Get hash	malicious	Unknown	Browse	18.141.10.107
	JUHGSyleu7.exe	Get hash	malicious	Unknown	Browse	18.141.10.107
	https://videostreamingsettlement.simplurisdev.com/form/choice	Get hash	malicious	Unknown	Browse	52.31.162.222
	345831980-17357046212.docx	Get hash	malicious	Unknown	Browse	52.217.11.44
	oUc5lyEzJy.exe	Get hash	malicious	Unknown	Browse	18.141.10.107
	JUHGSyleu7.exe	Get hash	malicious	Unknown	Browse	18.141.10.107
	345831980-17357046212.docx	Get hash	malicious	Unknown	Browse	52.92.237.50
	https://forms.zohopublic.com/tracyesmith/form/Processing/formperma/OwRtaxn46xyHexOvW9NGSoRj4ULObTZIo3_-Cp_3oLE	Get hash	malicious	Unknown	Browse	18.239.18.76
AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	oUc5lyEzJy.exe	Get hash	malicious	Unknown	Browse	103.169.142.0
	JUHGSyleu7.exe	Get hash	malicious	Unknown	Browse	103.169.142.0
	oUc5lyEzJy.exe	Get hash	malicious	Unknown	Browse	103.169.142.0
	JUHGSyleu7.exe	Get hash	malicious	Unknown	Browse	103.169.142.0
	AYV0eq1Gyc.exe	Get hash	malicious	AgentTesla	Browse	103.191.208.122
	GEFA-Order 232343-68983689.exe	Get hash	malicious	AgentTesla	Browse	103.191.208.122
	4wwi2Lh5W4.exe	Get hash	malicious	Unknown	Browse	103.169.142.0
	xQOrkxePXD.exe	Get hash	malicious	Remcos	Browse	103.186.117.228
	GEFA-Order 232343-68983689.exe	Get hash	malicious	AgentTesla	Browse	103.191.208.122
	na.elf	Get hash	malicious	Mirai	Browse	103.33.73.172
INFOWEBFUJITSULIMITEDJP	oUc5lyEzJy.exe	Get hash	malicious	Unknown	Browse	210.157.78.4
	JUHGSyleu7.exe	Get hash	malicious	Unknown	Browse	210.157.78.4
	oUc5lyEzJy.exe	Get hash	malicious	Unknown	Browse	210.157.78.4
	JUHGSyleu7.exe	Get hash	malicious	Unknown	Browse	210.157.78.4
	4wwi2Lh5W4.exe	Get hash	malicious	Unknown	Browse	210.157.78.4
	4wwi2Lh5W4.exe	Get hash	malicious	Unknown	Browse	210.157.78.4
	na.elf	Get hash	malicious	Mirai	Browse	115.176.47.87
	na.elf	Get hash	malicious	Mirai	Browse	125.3.3.221
	na.elf	Get hash	malicious	Unknown	Browse	121.94.184.93
	na.elf	Get hash	malicious	Unknown	Browse	218.226.230.115
AMAZON-02US	https://travelofarecom.wordpress.com/	Get hash	malicious	HTMLPhisher	Browse	3.254.33.149
	http://email.mx02.email-max.com/c/eJw8zrFy8iAAAOCnge33EEjAgcE_LVFrvcb0Wu3iQQDDBaLGxIt9-p4dOn_LZ0Q1m6HKQiumDHPKKCMM1kI7rozj1BnmEj5DjjuiqCOGpJozXkEvkjSdpoQiQFEc0XRio_LhX1TjpDpFGETd92dA5gBLgOWptcG3jTcPBFj2AEuaFV_LN7Tf7-7_E7QaLx3Khxw1K71E-e6pxgnA8naZl8-fi_O2zV77fN583DZDuZZZua1d-b3JYlduxvXw0haq6oti8d55GeyoOt_CeD9Ee72qoz148_eFnVDa2OCDqidKm9PQaEDR8dH_rd8E_gkAAP__7g5YOw	Get hash	malicious	Phisher	Browse	18.239.83.18
	oUc5lyEzJy.exe	Get hash	malicious	Unknown	Browse	18.141.10.107
	JUHGSyleu7.exe	Get hash	malicious	Unknown	Browse	18.141.10.107
	https://videostreamingsettlement.simplurisdev.com/form/choice	Get hash	malicious	Unknown	Browse	52.31.162.222
	345831980-17357046212.docx	Get hash	malicious	Unknown	Browse	52.217.11.44
	oUc5lyEzJy.exe	Get hash	malicious	Unknown	Browse	18.141.10.107
	JUHGSyleu7.exe	Get hash	malicious	Unknown	Browse	18.141.10.107
	345831980-17357046212.docx	Get hash	malicious	Unknown	Browse	52.92.237.50
	https://forms.zohopublic.com/tracyesmith/form/Processing/formperma/OwRtaxn46xyHexOvW9NGSoRj4ULObTZIo3_-Cp_3oLE	Get hash	malicious	Unknown	Browse	18.239.18.76

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Windows\bamqdjw\txadnumgtelp

Download File

Process:	C:\Users\user\Desktop\25XrVZw56S.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.418295834054489
Encrypted:	false
SSDEEP:	3:TJkBw2H:dy
MD5:	51370537A215E7B9AC1FF93754EC9285
SHA1:	62FD15F9C823DF06ABB425067E7C67B01416515E
SHA-256:	0703F3CE2F5C29DB5281579503C452B621E5BD5CAE436D92B5A965965634015A
SHA-512:	7259A4EEE45F3508AB9A6FA8372C8123039D7BD8ED7A0908022CAD4F48DD5E9425DEC8E6F97592ECBAD039E575126390C70A9F4D176CDD71E1291512F146CD92
Malicious:	false
Reputation:	low
Preview:	.lkO.dkz.6n

C:\bamqdjw\czmruiag.exe

Download File

Process:	C:\bamqdjw\erewpegtq.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	442368
Entropy (8bit):	6.754278551913293
Encrypted:	false
SSDEEP:	6144:QwIZebrlwdZcNMvKwcYP59nxvetLxuR/hcfqaguOY/vS02eEKxv3X:RIZeGnsYB9nxGqR/hrag/Y/hpt3X
MD5:	D2965931E5463A26443A022B95EDF5D4
SHA1:	6BFDE34CE3D9EF20F5265FF5045FD2411A9F3655
SHA-256:	6BA07E3E540B3A47A2A136C0320E55B4BA6E388241E7408EBEE798C92AE324D9
SHA-512:	40F50D45CDDCB91AAF66B55A5BD7352549A28DA0EE8A221F433697C439D3102AC69298314E51C050F94A895A95A5C4F72B1A71038CFDE0690758515AF6570B1D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 89%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......oe..+..M+..M+..M...M(..M+..Mu..M...M)..M&V.M7..M&V3M...M&V2M...MV}2M..MV}.M..MRich+..M........PE..L.....CV.................T...................p....@.......................................@..................................F..(................................j...................................2..@............p..\|............................text....R.......T.................. ..`.rdata..F....p.......X..............@..@.data...\E...P.......8..............@....reloc...j.......l...T..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\bamqdjw\erewpegtq.exe

Download File

Process:	C:\bamqdjw\mt2o4nrsazl5davsv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	442368
Entropy (8bit):	6.754278551913293
Encrypted:	false
SSDEEP:	6144:QwIZebrlwdZcNMvKwcYP59nxvetLxuR/hcfqaguOY/vS02eEKxv3X:RIZeGnsYB9nxGqR/hrag/Y/hpt3X
MD5:	D2965931E5463A26443A022B95EDF5D4
SHA1:	6BFDE34CE3D9EF20F5265FF5045FD2411A9F3655
SHA-256:	6BA07E3E540B3A47A2A136C0320E55B4BA6E388241E7408EBEE798C92AE324D9
SHA-512:	40F50D45CDDCB91AAF66B55A5BD7352549A28DA0EE8A221F433697C439D3102AC69298314E51C050F94A895A95A5C4F72B1A71038CFDE0690758515AF6570B1D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 89%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......oe..+..M+..M+..M...M(..M+..Mu..M...M)..M&V.M7..M&V3M...M&V2M...MV}2M..MV}.M..MRich+..M........PE..L.....CV.................T...................p....@.......................................@..................................F..(................................j...................................2..@............p..\|............................text....R.......T.................. ..`.rdata..F....p.......X..............@..@.data...\E...P.......8..............@....reloc...j.......l...T..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\bamqdjw\mt2o4nrsazl5davsv.exe

Download File

Process:	C:\Users\user\Desktop\25XrVZw56S.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	442368
Entropy (8bit):	6.754278551913293
Encrypted:	false
SSDEEP:	6144:QwIZebrlwdZcNMvKwcYP59nxvetLxuR/hcfqaguOY/vS02eEKxv3X:RIZeGnsYB9nxGqR/hrag/Y/hpt3X
MD5:	D2965931E5463A26443A022B95EDF5D4
SHA1:	6BFDE34CE3D9EF20F5265FF5045FD2411A9F3655
SHA-256:	6BA07E3E540B3A47A2A136C0320E55B4BA6E388241E7408EBEE798C92AE324D9
SHA-512:	40F50D45CDDCB91AAF66B55A5BD7352549A28DA0EE8A221F433697C439D3102AC69298314E51C050F94A895A95A5C4F72B1A71038CFDE0690758515AF6570B1D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 89%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......oe..+..M+..M+..M...M(..M+..Mu..M...M)..M&V.M7..M&V3M...M&V2M...MV}2M..MV}.M..MRich+..M........PE..L.....CV.................T...................p....@.......................................@..................................F..(................................j...................................2..@............p..\|............................text....R.......T.................. ..`.rdata..F....p.......X..............@..@.data...\E...P.......8..............@....reloc...j.......l...T..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\bamqdjw\txadnumgtelp

Download File

Process:	C:\Users\user\Desktop\25XrVZw56S.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.418295834054489
Encrypted:	false
SSDEEP:	3:TJkBw2H:dy
MD5:	51370537A215E7B9AC1FF93754EC9285
SHA1:	62FD15F9C823DF06ABB425067E7C67B01416515E
SHA-256:	0703F3CE2F5C29DB5281579503C452B621E5BD5CAE436D92B5A965965634015A
SHA-512:	7259A4EEE45F3508AB9A6FA8372C8123039D7BD8ED7A0908022CAD4F48DD5E9425DEC8E6F97592ECBAD039E575126390C70A9F4D176CDD71E1291512F146CD92
Malicious:	false
Reputation:	low
Preview:	.lkO.dkz.6n

C:\bamqdjw\y7sukma

Download File

Process:	C:\bamqdjw\erewpegtq.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:G4:v
MD5:	A2EBB6D9A6052B77382278ABCD813BE9
SHA1:	4E019834606FA55680740BD9063883B69B0C03B3
SHA-256:	474A709CA3B343BB9CD3E9A38B5C32FA7167CF2EBF94832D799E66A250A50930
SHA-512:	F176A91F0C5D9A033FA093DA52E63BAE52E797F3FB5F42D209489DE88C019B1BFA66328C5F5938051CA9396989775E5EFEB083B74FBC33FF07F8431EFC944D0D
Malicious:	false
Reputation:	low
Preview:	_}..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.754278551913293
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	25XrVZw56S.exe
File size:	442'368 bytes
MD5:	d2965931e5463a26443a022b95edf5d4
SHA1:	6bfde34ce3d9ef20f5265ff5045fd2411a9f3655
SHA256:	6ba07e3e540b3a47a2a136c0320e55b4ba6e388241e7408ebee798c92ae324d9
SHA512:	40f50d45cddcb91aaf66b55a5bd7352549a28da0ee8a221f433697c439d3102ac69298314e51c050f94a895a95a5c4f72b1a71038cfde0690758515af6570b1d
SSDEEP:	6144:QwIZebrlwdZcNMvKwcYP59nxvetLxuR/hcfqaguOY/vS02eEKxv3X:RIZeGnsYB9nxGqR/hrag/Y/hpt3X
TLSH:	77945B0430D3D136E4A3A1F68A7AA32691BD7A6023B549C7AFD44D5C4FA84D0BF7721E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......oe..+..M+..M+..M...M(..M+..Mu..M...M)..M&V.M7..M&V3M...M&V2M...MV}2M..MV}.M..MRich+..M........PE..L.....CV.................T.

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x42eea4
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5643CC86 [Wed Nov 11 23:17:26 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	0766f11ac9fb2b35dec02aa0639d9b13

Entrypoint Preview

Instruction
call 00007FEDC9288351h
jmp 00007FEDC927AE95h
push 00000014h
push 00463DE8h
call 00007FEDC927BDCBh
call 00007FEDC927C8C9h
movzx esi, ax
push 00000002h
call 00007FEDC92882E4h
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007FEDC927AE96h
xor ebx, ebx
jmp 00007FEDC927AEC5h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007FEDC927AE7Dh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007FEDC927AE6Fh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007FEDC927AE9Bh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007FEDC927EA11h
test eax, eax
jne 00007FEDC927AE9Ah
push 0000001Ch
call 00007FEDC927AFB7h
pop ecx
call 00007FEDC927E967h
test eax, eax
jne 00007FEDC927AE9Ah
push 00000010h
call 00007FEDC927AFA6h
pop ecx
call 00007FEDC927C429h
and dword ptr [ebp-04h], 00000000h
call 00007FEDC92864F9h
test eax, eax
jns 00007FEDC927AE9Ah
push 0000001Bh
call 00007FEDC927AF8Ch
pop ecx
call dword ptr [00457034h]
mov dword ptr [00469544h], eax
call 00007FEDC9288338h
mov dword ptr [00467600h], eax
call 00007FEDC9287F35h
test eax, eax
jns 00007FEDC927AE9Ah

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[C++] VS2013 UPD4 build 31101
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6469c	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6a000	0x6ab0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x632d0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x57000	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x55201	0x55400	9215b304eeb92c502ca29b33dc3b8d8d	False	0.49784927144428154	data	6.588366382936304	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x57000	0xdf46	0xe000	2a0dc6f8431d9ad754bf3a20a094e6bd	False	0.5607561383928571	data	5.901302880862981	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x65000	0x455c	0x1c00	7cf078597e38cdc91ff0cd29bb7986e7	False	0.41587611607142855	data	4.377538071984764	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x6a000	0x6ab0	0x6c00	3cc9d3ae258c1ff551117df257cc3a03	False	0.7344473379629629	data	6.795471824368773	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

GetModuleHandleA, GetProcAddress, EncodePointer, DecodePointer, GetLastError, ExitProcess, GetModuleHandleExW, AreFileApisANSI, MultiByteToWideChar, WideCharToMultiByte, HeapFree, HeapAlloc, GetSystemTimeAsFileTime, GetCommandLineA, RaiseException, RtlUnwind, IsProcessorFeaturePresent, HeapSize, IsDebuggerPresent, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, FatalAppExitA, UnhandledExceptionFilter, SetUnhandledExceptionFilter, SetLastError, InitializeCriticalSectionAndSpinCount, CreateEventW, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetTickCount, GetModuleHandleW, CreateSemaphoreW, GetStdHandle, WriteFile, GetModuleFileNameW, SetConsoleCtrlHandler, FreeLibrary, LoadLibraryExW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCurrentThread, GetCurrentThreadId, GetProcessHeap, FindClose, FindFirstFileExW, GetDriveTypeW, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, CloseHandle, FlushFileBuffers, GetConsoleCP, GetConsoleMode, GetFileType, GetModuleFileNameA, QueryPerformanceCounter, GetCurrentProcessId, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetDateFormatW, GetTimeFormatW, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, HeapReAlloc, OutputDebugStringW, GetStringTypeW, FileTimeToLocalFileTime, GetFileInformationByHandle, PeekNamedPipe, GetFullPathNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, CreateFileW, SetStdHandle, SetFilePointerEx, WriteConsoleW, GetTimeZoneInformation, SetEndOfFile, ReadFile, ReadConsoleW, GetFullPathNameA, SetEnvironmentVariableA

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-09T16:27:22.073475+0200	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	1	192.168.2.4	49730	54.244.188.177	80	TCP
2024-10-09T16:27:22.073475+0200	2820680	ETPRO MALWARE W32/Bayrob Attempted Checkin 2	1	192.168.2.4	49730	54.244.188.177	80	TCP
2024-10-09T16:27:22.078360+0200	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	54.244.188.177	80	192.168.2.4	49730	TCP
2024-10-09T16:27:22.078360+0200	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	54.244.188.177	80	192.168.2.4	49730	TCP
2024-10-09T16:27:22.372050+0200	2811542	ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net)	1	1.1.1.1	53	192.168.2.4	64469	UDP
2024-10-09T16:28:39.802352+0200	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	1	192.168.2.4	50397	54.244.188.177	80	TCP
2024-10-09T16:28:39.802352+0200	2820680	ETPRO MALWARE W32/Bayrob Attempted Checkin 2	1	192.168.2.4	50397	54.244.188.177	80	TCP
2024-10-09T16:28:49.643108+0200	2811542	ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net)	1	1.1.1.1	53	192.168.2.4	52475	UDP
2024-10-09T16:28:52.061806+0200	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	34.218.204.173	80	192.168.2.4	50467	TCP
2024-10-09T16:28:52.061806+0200	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	34.218.204.173	80	192.168.2.4	50467	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 9, 2024 16:27:21.337160110 CEST	49730	80	192.168.2.4	54.244.188.177
Oct 9, 2024 16:27:21.342119932 CEST	80	49730	54.244.188.177	192.168.2.4
Oct 9, 2024 16:27:21.342273951 CEST	49730	80	192.168.2.4	54.244.188.177
Oct 9, 2024 16:27:21.342403889 CEST	49730	80	192.168.2.4	54.244.188.177
Oct 9, 2024 16:27:21.347309113 CEST	80	49730	54.244.188.177	192.168.2.4
Oct 9, 2024 16:27:22.072129965 CEST	80	49730	54.244.188.177	192.168.2.4
Oct 9, 2024 16:27:22.073348999 CEST	80	49730	54.244.188.177	192.168.2.4
Oct 9, 2024 16:27:22.073474884 CEST	49730	80	192.168.2.4	54.244.188.177
Oct 9, 2024 16:27:22.073474884 CEST	49730	80	192.168.2.4	54.244.188.177
Oct 9, 2024 16:27:22.078360081 CEST	80	49730	54.244.188.177	192.168.2.4
Oct 9, 2024 16:27:23.316868067 CEST	50245	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:27:23.323628902 CEST	80	50245	34.218.204.173	192.168.2.4
Oct 9, 2024 16:27:23.323703051 CEST	50245	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:27:23.323750019 CEST	50245	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:27:23.330549955 CEST	80	50245	34.218.204.173	192.168.2.4
Oct 9, 2024 16:27:24.080430031 CEST	80	50245	34.218.204.173	192.168.2.4
Oct 9, 2024 16:27:24.081770897 CEST	80	50245	34.218.204.173	192.168.2.4
Oct 9, 2024 16:27:24.081856966 CEST	50245	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:27:24.081933975 CEST	50245	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:27:24.086755037 CEST	80	50245	34.218.204.173	192.168.2.4
Oct 9, 2024 16:27:24.458663940 CEST	50246	80	192.168.2.4	52.71.57.184
Oct 9, 2024 16:27:24.464812994 CEST	80	50246	52.71.57.184	192.168.2.4
Oct 9, 2024 16:27:24.464903116 CEST	50246	80	192.168.2.4	52.71.57.184
Oct 9, 2024 16:27:24.464997053 CEST	50246	80	192.168.2.4	52.71.57.184
Oct 9, 2024 16:27:24.470808983 CEST	80	50246	52.71.57.184	192.168.2.4
Oct 9, 2024 16:27:24.951749086 CEST	80	50246	52.71.57.184	192.168.2.4
Oct 9, 2024 16:27:24.951776028 CEST	80	50246	52.71.57.184	192.168.2.4
Oct 9, 2024 16:27:24.951878071 CEST	50246	80	192.168.2.4	52.71.57.184
Oct 9, 2024 16:27:24.951960087 CEST	50246	80	192.168.2.4	52.71.57.184
Oct 9, 2024 16:27:24.956792116 CEST	80	50246	52.71.57.184	192.168.2.4
Oct 9, 2024 16:27:25.585968971 CEST	50247	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:27:25.590868950 CEST	80	50247	199.59.243.227	192.168.2.4
Oct 9, 2024 16:27:25.590969086 CEST	50247	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:27:25.591036081 CEST	50247	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:27:25.595896006 CEST	80	50247	199.59.243.227	192.168.2.4
Oct 9, 2024 16:27:26.078423023 CEST	80	50247	199.59.243.227	192.168.2.4
Oct 9, 2024 16:27:26.078448057 CEST	80	50247	199.59.243.227	192.168.2.4
Oct 9, 2024 16:27:26.078460932 CEST	80	50247	199.59.243.227	192.168.2.4
Oct 9, 2024 16:27:26.078541994 CEST	50247	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:27:26.078572035 CEST	50247	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:27:26.078702927 CEST	50247	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:27:26.084701061 CEST	80	50247	199.59.243.227	192.168.2.4
Oct 9, 2024 16:28:39.063661098 CEST	50397	80	192.168.2.4	54.244.188.177
Oct 9, 2024 16:28:39.068547964 CEST	80	50397	54.244.188.177	192.168.2.4
Oct 9, 2024 16:28:39.068650007 CEST	50397	80	192.168.2.4	54.244.188.177
Oct 9, 2024 16:28:39.068682909 CEST	50397	80	192.168.2.4	54.244.188.177
Oct 9, 2024 16:28:39.073590994 CEST	80	50397	54.244.188.177	192.168.2.4
Oct 9, 2024 16:28:39.802243948 CEST	80	50397	54.244.188.177	192.168.2.4
Oct 9, 2024 16:28:39.802294016 CEST	80	50397	54.244.188.177	192.168.2.4
Oct 9, 2024 16:28:39.802351952 CEST	50397	80	192.168.2.4	54.244.188.177
Oct 9, 2024 16:28:39.802438974 CEST	50397	80	192.168.2.4	54.244.188.177
Oct 9, 2024 16:28:39.807442904 CEST	80	50397	54.244.188.177	192.168.2.4
Oct 9, 2024 16:28:40.196997881 CEST	50404	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:28:40.202621937 CEST	80	50404	34.218.204.173	192.168.2.4
Oct 9, 2024 16:28:40.202694893 CEST	50404	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:28:40.202727079 CEST	50404	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:28:40.208137989 CEST	80	50404	34.218.204.173	192.168.2.4
Oct 9, 2024 16:28:41.879479885 CEST	80	50404	34.218.204.173	192.168.2.4
Oct 9, 2024 16:28:41.879496098 CEST	80	50404	34.218.204.173	192.168.2.4
Oct 9, 2024 16:28:41.879503965 CEST	80	50404	34.218.204.173	192.168.2.4
Oct 9, 2024 16:28:41.879612923 CEST	50404	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:28:41.879645109 CEST	50404	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:28:41.879776001 CEST	80	50404	34.218.204.173	192.168.2.4
Oct 9, 2024 16:28:41.879816055 CEST	50404	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:28:41.880465031 CEST	80	50404	34.218.204.173	192.168.2.4
Oct 9, 2024 16:28:41.880511045 CEST	50404	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:28:41.889287949 CEST	80	50404	34.218.204.173	192.168.2.4
Oct 9, 2024 16:28:42.248538971 CEST	50414	80	192.168.2.4	54.209.32.212
Oct 9, 2024 16:28:42.253334045 CEST	80	50414	54.209.32.212	192.168.2.4
Oct 9, 2024 16:28:42.253520012 CEST	50414	80	192.168.2.4	54.209.32.212
Oct 9, 2024 16:28:42.253575087 CEST	50414	80	192.168.2.4	54.209.32.212
Oct 9, 2024 16:28:42.258474112 CEST	80	50414	54.209.32.212	192.168.2.4
Oct 9, 2024 16:28:42.731489897 CEST	80	50414	54.209.32.212	192.168.2.4
Oct 9, 2024 16:28:42.731848001 CEST	80	50414	54.209.32.212	192.168.2.4
Oct 9, 2024 16:28:42.732413054 CEST	50414	80	192.168.2.4	54.209.32.212
Oct 9, 2024 16:28:42.732913017 CEST	50414	80	192.168.2.4	54.209.32.212
Oct 9, 2024 16:28:42.737874031 CEST	80	50414	54.209.32.212	192.168.2.4
Oct 9, 2024 16:28:42.933646917 CEST	50418	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:28:42.938553095 CEST	80	50418	199.59.243.227	192.168.2.4
Oct 9, 2024 16:28:42.938662052 CEST	50418	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:28:42.938688040 CEST	50418	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:28:42.944190025 CEST	80	50418	199.59.243.227	192.168.2.4
Oct 9, 2024 16:28:43.444996119 CEST	80	50418	199.59.243.227	192.168.2.4
Oct 9, 2024 16:28:43.445487976 CEST	80	50418	199.59.243.227	192.168.2.4
Oct 9, 2024 16:28:43.445521116 CEST	80	50418	199.59.243.227	192.168.2.4
Oct 9, 2024 16:28:43.445579052 CEST	80	50418	199.59.243.227	192.168.2.4
Oct 9, 2024 16:28:43.445625067 CEST	50418	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:28:43.445657015 CEST	50418	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:28:43.445817947 CEST	50418	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:28:43.450700045 CEST	80	50418	199.59.243.227	192.168.2.4
Oct 9, 2024 16:28:50.181432009 CEST	50458	80	192.168.2.4	54.244.188.177
Oct 9, 2024 16:28:50.186306000 CEST	80	50458	54.244.188.177	192.168.2.4
Oct 9, 2024 16:28:50.186371088 CEST	50458	80	192.168.2.4	54.244.188.177
Oct 9, 2024 16:28:50.186424017 CEST	50458	80	192.168.2.4	54.244.188.177
Oct 9, 2024 16:28:50.191266060 CEST	80	50458	54.244.188.177	192.168.2.4
Oct 9, 2024 16:28:50.925986052 CEST	80	50458	54.244.188.177	192.168.2.4
Oct 9, 2024 16:28:50.926145077 CEST	80	50458	54.244.188.177	192.168.2.4
Oct 9, 2024 16:28:50.926320076 CEST	50458	80	192.168.2.4	54.244.188.177
Oct 9, 2024 16:28:50.926320076 CEST	50458	80	192.168.2.4	54.244.188.177
Oct 9, 2024 16:28:50.931202888 CEST	80	50458	54.244.188.177	192.168.2.4
Oct 9, 2024 16:28:51.291238070 CEST	50467	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:28:51.296946049 CEST	80	50467	34.218.204.173	192.168.2.4
Oct 9, 2024 16:28:51.297030926 CEST	50467	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:28:51.297095060 CEST	50467	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:28:51.303119898 CEST	80	50467	34.218.204.173	192.168.2.4
Oct 9, 2024 16:28:52.056229115 CEST	80	50467	34.218.204.173	192.168.2.4
Oct 9, 2024 16:28:52.056427956 CEST	80	50467	34.218.204.173	192.168.2.4
Oct 9, 2024 16:28:52.056469917 CEST	50467	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:28:52.056497097 CEST	50467	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:28:52.061805964 CEST	80	50467	34.218.204.173	192.168.2.4
Oct 9, 2024 16:28:52.167830944 CEST	50473	80	192.168.2.4	54.209.32.212
Oct 9, 2024 16:28:52.172657013 CEST	80	50473	54.209.32.212	192.168.2.4
Oct 9, 2024 16:28:52.172729969 CEST	50473	80	192.168.2.4	54.209.32.212
Oct 9, 2024 16:28:52.172791004 CEST	50473	80	192.168.2.4	54.209.32.212
Oct 9, 2024 16:28:52.177733898 CEST	80	50473	54.209.32.212	192.168.2.4
Oct 9, 2024 16:28:52.632476091 CEST	80	50473	54.209.32.212	192.168.2.4
Oct 9, 2024 16:28:52.632646084 CEST	80	50473	54.209.32.212	192.168.2.4
Oct 9, 2024 16:28:52.632704020 CEST	50473	80	192.168.2.4	54.209.32.212
Oct 9, 2024 16:28:52.632739067 CEST	50473	80	192.168.2.4	54.209.32.212
Oct 9, 2024 16:28:52.637610912 CEST	80	50473	54.209.32.212	192.168.2.4
Oct 9, 2024 16:28:53.120981932 CEST	50480	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:28:53.127734900 CEST	80	50480	199.59.243.227	192.168.2.4
Oct 9, 2024 16:28:53.127825975 CEST	50480	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:28:53.127873898 CEST	50480	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:28:53.132786989 CEST	80	50480	199.59.243.227	192.168.2.4
Oct 9, 2024 16:28:53.593441963 CEST	80	50480	199.59.243.227	192.168.2.4
Oct 9, 2024 16:28:53.593458891 CEST	80	50480	199.59.243.227	192.168.2.4
Oct 9, 2024 16:28:53.593555927 CEST	50480	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:28:53.593575001 CEST	80	50480	199.59.243.227	192.168.2.4
Oct 9, 2024 16:28:53.593628883 CEST	50480	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:28:53.593676090 CEST	50480	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:28:53.598431110 CEST	80	50480	199.59.243.227	192.168.2.4
Oct 9, 2024 16:28:54.551148891 CEST	50487	80	192.168.2.4	210.157.78.4
Oct 9, 2024 16:28:54.556787014 CEST	80	50487	210.157.78.4	192.168.2.4
Oct 9, 2024 16:28:54.556859016 CEST	50487	80	192.168.2.4	210.157.78.4
Oct 9, 2024 16:28:54.560416937 CEST	50487	80	192.168.2.4	210.157.78.4
Oct 9, 2024 16:28:54.565311909 CEST	80	50487	210.157.78.4	192.168.2.4
Oct 9, 2024 16:28:55.363424063 CEST	80	50487	210.157.78.4	192.168.2.4
Oct 9, 2024 16:28:55.363487005 CEST	80	50487	210.157.78.4	192.168.2.4
Oct 9, 2024 16:28:55.363524914 CEST	80	50487	210.157.78.4	192.168.2.4
Oct 9, 2024 16:28:55.363559008 CEST	80	50487	210.157.78.4	192.168.2.4
Oct 9, 2024 16:28:55.363564968 CEST	50487	80	192.168.2.4	210.157.78.4
Oct 9, 2024 16:28:55.363615990 CEST	50487	80	192.168.2.4	210.157.78.4
Oct 9, 2024 16:28:55.363683939 CEST	50487	80	192.168.2.4	210.157.78.4
Oct 9, 2024 16:28:55.368545055 CEST	80	50487	210.157.78.4	192.168.2.4
Oct 9, 2024 16:29:00.678030014 CEST	50523	80	192.168.2.4	54.244.188.177
Oct 9, 2024 16:29:00.683589935 CEST	80	50523	54.244.188.177	192.168.2.4
Oct 9, 2024 16:29:00.683676004 CEST	50523	80	192.168.2.4	54.244.188.177
Oct 9, 2024 16:29:00.683763027 CEST	50523	80	192.168.2.4	54.244.188.177
Oct 9, 2024 16:29:00.689603090 CEST	80	50523	54.244.188.177	192.168.2.4
Oct 9, 2024 16:29:01.401902914 CEST	80	50523	54.244.188.177	192.168.2.4
Oct 9, 2024 16:29:01.402239084 CEST	80	50523	54.244.188.177	192.168.2.4
Oct 9, 2024 16:29:01.402293921 CEST	50523	80	192.168.2.4	54.244.188.177
Oct 9, 2024 16:29:01.402354956 CEST	50523	80	192.168.2.4	54.244.188.177
Oct 9, 2024 16:29:01.407080889 CEST	80	50523	54.244.188.177	192.168.2.4
Oct 9, 2024 16:29:01.657883883 CEST	50529	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:29:01.663266897 CEST	80	50529	34.218.204.173	192.168.2.4
Oct 9, 2024 16:29:01.663345098 CEST	50529	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:29:01.663429022 CEST	50529	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:29:01.668653965 CEST	80	50529	34.218.204.173	192.168.2.4
Oct 9, 2024 16:29:02.385793924 CEST	80	50529	34.218.204.173	192.168.2.4
Oct 9, 2024 16:29:02.386218071 CEST	80	50529	34.218.204.173	192.168.2.4
Oct 9, 2024 16:29:02.386293888 CEST	50529	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:29:02.386329889 CEST	50529	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:29:02.391340017 CEST	80	50529	34.218.204.173	192.168.2.4
Oct 9, 2024 16:29:02.534049988 CEST	50531	80	192.168.2.4	54.209.32.212
Oct 9, 2024 16:29:02.539154053 CEST	80	50531	54.209.32.212	192.168.2.4
Oct 9, 2024 16:29:02.539288998 CEST	50531	80	192.168.2.4	54.209.32.212
Oct 9, 2024 16:29:02.539334059 CEST	50531	80	192.168.2.4	54.209.32.212
Oct 9, 2024 16:29:02.544224977 CEST	80	50531	54.209.32.212	192.168.2.4
Oct 9, 2024 16:29:03.000838041 CEST	80	50531	54.209.32.212	192.168.2.4
Oct 9, 2024 16:29:03.000960112 CEST	80	50531	54.209.32.212	192.168.2.4
Oct 9, 2024 16:29:03.001019001 CEST	50531	80	192.168.2.4	54.209.32.212
Oct 9, 2024 16:29:03.001085043 CEST	50531	80	192.168.2.4	54.209.32.212
Oct 9, 2024 16:29:03.006329060 CEST	80	50531	54.209.32.212	192.168.2.4
Oct 9, 2024 16:29:03.535056114 CEST	50532	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:29:03.539978981 CEST	80	50532	199.59.243.227	192.168.2.4
Oct 9, 2024 16:29:03.540112972 CEST	50532	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:29:03.540185928 CEST	50532	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:29:03.546087027 CEST	80	50532	199.59.243.227	192.168.2.4
Oct 9, 2024 16:29:04.018954039 CEST	80	50532	199.59.243.227	192.168.2.4
Oct 9, 2024 16:29:04.019299030 CEST	80	50532	199.59.243.227	192.168.2.4
Oct 9, 2024 16:29:04.019330025 CEST	80	50532	199.59.243.227	192.168.2.4
Oct 9, 2024 16:29:04.019419909 CEST	50532	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:29:04.019419909 CEST	50532	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:29:04.019462109 CEST	50532	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:29:04.024842978 CEST	80	50532	199.59.243.227	192.168.2.4
Oct 9, 2024 16:29:04.532557964 CEST	50533	80	192.168.2.4	210.157.78.4
Oct 9, 2024 16:29:04.537363052 CEST	80	50533	210.157.78.4	192.168.2.4
Oct 9, 2024 16:29:04.537482977 CEST	50533	80	192.168.2.4	210.157.78.4
Oct 9, 2024 16:29:04.537552118 CEST	50533	80	192.168.2.4	210.157.78.4
Oct 9, 2024 16:29:04.542402983 CEST	80	50533	210.157.78.4	192.168.2.4
Oct 9, 2024 16:29:05.731906891 CEST	80	50533	210.157.78.4	192.168.2.4
Oct 9, 2024 16:29:05.731923103 CEST	80	50533	210.157.78.4	192.168.2.4
Oct 9, 2024 16:29:05.731930017 CEST	80	50533	210.157.78.4	192.168.2.4
Oct 9, 2024 16:29:05.731947899 CEST	80	50533	210.157.78.4	192.168.2.4
Oct 9, 2024 16:29:05.731959105 CEST	80	50533	210.157.78.4	192.168.2.4
Oct 9, 2024 16:29:05.732007027 CEST	80	50533	210.157.78.4	192.168.2.4
Oct 9, 2024 16:29:05.732125998 CEST	50533	80	192.168.2.4	210.157.78.4
Oct 9, 2024 16:29:05.732125998 CEST	50533	80	192.168.2.4	210.157.78.4
Oct 9, 2024 16:29:05.732364893 CEST	50533	80	192.168.2.4	210.157.78.4
Oct 9, 2024 16:29:05.733041048 CEST	80	50533	210.157.78.4	192.168.2.4
Oct 9, 2024 16:29:05.733100891 CEST	50533	80	192.168.2.4	210.157.78.4
Oct 9, 2024 16:29:05.737544060 CEST	80	50533	210.157.78.4	192.168.2.4
Oct 9, 2024 16:29:05.999417067 CEST	50534	80	192.168.2.4	185.111.247.38
Oct 9, 2024 16:29:06.004560947 CEST	80	50534	185.111.247.38	192.168.2.4
Oct 9, 2024 16:29:06.004779100 CEST	50534	80	192.168.2.4	185.111.247.38
Oct 9, 2024 16:29:06.004967928 CEST	50534	80	192.168.2.4	185.111.247.38
Oct 9, 2024 16:29:06.010490894 CEST	80	50534	185.111.247.38	192.168.2.4
Oct 9, 2024 16:29:06.833544016 CEST	80	50534	185.111.247.38	192.168.2.4
Oct 9, 2024 16:29:06.833931923 CEST	80	50534	185.111.247.38	192.168.2.4
Oct 9, 2024 16:29:06.834034920 CEST	50534	80	192.168.2.4	185.111.247.38
Oct 9, 2024 16:29:06.834707022 CEST	50534	80	192.168.2.4	185.111.247.38
Oct 9, 2024 16:29:06.839569092 CEST	80	50534	185.111.247.38	192.168.2.4
Oct 9, 2024 16:29:12.080616951 CEST	50535	80	192.168.2.4	54.244.188.177
Oct 9, 2024 16:29:12.085550070 CEST	80	50535	54.244.188.177	192.168.2.4
Oct 9, 2024 16:29:12.085625887 CEST	50535	80	192.168.2.4	54.244.188.177
Oct 9, 2024 16:29:12.085675001 CEST	50535	80	192.168.2.4	54.244.188.177
Oct 9, 2024 16:29:12.090579987 CEST	80	50535	54.244.188.177	192.168.2.4
Oct 9, 2024 16:29:13.040664911 CEST	80	50535	54.244.188.177	192.168.2.4
Oct 9, 2024 16:29:13.040694952 CEST	80	50535	54.244.188.177	192.168.2.4
Oct 9, 2024 16:29:13.040704966 CEST	80	50535	54.244.188.177	192.168.2.4
Oct 9, 2024 16:29:13.040791035 CEST	50535	80	192.168.2.4	54.244.188.177
Oct 9, 2024 16:29:13.041086912 CEST	50535	80	192.168.2.4	54.244.188.177
Oct 9, 2024 16:29:13.046044111 CEST	80	50535	54.244.188.177	192.168.2.4
Oct 9, 2024 16:29:13.230146885 CEST	50536	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:29:13.234988928 CEST	80	50536	34.218.204.173	192.168.2.4
Oct 9, 2024 16:29:13.235075951 CEST	50536	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:29:13.235224962 CEST	50536	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:29:13.240082026 CEST	80	50536	34.218.204.173	192.168.2.4
Oct 9, 2024 16:29:13.986573935 CEST	80	50536	34.218.204.173	192.168.2.4
Oct 9, 2024 16:29:13.986593962 CEST	80	50536	34.218.204.173	192.168.2.4
Oct 9, 2024 16:29:13.986799955 CEST	50536	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:29:13.986836910 CEST	50536	80	192.168.2.4	34.218.204.173
Oct 9, 2024 16:29:13.991719961 CEST	80	50536	34.218.204.173	192.168.2.4
Oct 9, 2024 16:29:14.122844934 CEST	50537	80	192.168.2.4	54.209.32.212
Oct 9, 2024 16:29:14.127693892 CEST	80	50537	54.209.32.212	192.168.2.4
Oct 9, 2024 16:29:14.127779961 CEST	50537	80	192.168.2.4	54.209.32.212
Oct 9, 2024 16:29:14.127835035 CEST	50537	80	192.168.2.4	54.209.32.212
Oct 9, 2024 16:29:14.132927895 CEST	80	50537	54.209.32.212	192.168.2.4
Oct 9, 2024 16:29:14.606399059 CEST	80	50537	54.209.32.212	192.168.2.4
Oct 9, 2024 16:29:14.606537104 CEST	80	50537	54.209.32.212	192.168.2.4
Oct 9, 2024 16:29:14.606646061 CEST	50537	80	192.168.2.4	54.209.32.212
Oct 9, 2024 16:29:14.607170105 CEST	50537	80	192.168.2.4	54.209.32.212
Oct 9, 2024 16:29:14.612888098 CEST	80	50537	54.209.32.212	192.168.2.4
Oct 9, 2024 16:29:15.003959894 CEST	50538	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:29:15.009037971 CEST	80	50538	199.59.243.227	192.168.2.4
Oct 9, 2024 16:29:15.009206057 CEST	50538	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:29:15.009206057 CEST	50538	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:29:15.015614033 CEST	80	50538	199.59.243.227	192.168.2.4
Oct 9, 2024 16:29:15.492477894 CEST	80	50538	199.59.243.227	192.168.2.4
Oct 9, 2024 16:29:15.492516994 CEST	80	50538	199.59.243.227	192.168.2.4
Oct 9, 2024 16:29:15.492558956 CEST	80	50538	199.59.243.227	192.168.2.4
Oct 9, 2024 16:29:15.492789030 CEST	50538	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:29:15.492789030 CEST	50538	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:29:15.492789984 CEST	50538	80	192.168.2.4	199.59.243.227
Oct 9, 2024 16:29:15.497756004 CEST	80	50538	199.59.243.227	192.168.2.4
Oct 9, 2024 16:29:16.147420883 CEST	50539	80	192.168.2.4	210.157.78.4
Oct 9, 2024 16:29:16.153141022 CEST	80	50539	210.157.78.4	192.168.2.4
Oct 9, 2024 16:29:16.153242111 CEST	50539	80	192.168.2.4	210.157.78.4
Oct 9, 2024 16:29:16.153285027 CEST	50539	80	192.168.2.4	210.157.78.4
Oct 9, 2024 16:29:16.158224106 CEST	80	50539	210.157.78.4	192.168.2.4
Oct 9, 2024 16:29:16.946599007 CEST	80	50539	210.157.78.4	192.168.2.4
Oct 9, 2024 16:29:16.946628094 CEST	80	50539	210.157.78.4	192.168.2.4
Oct 9, 2024 16:29:16.946638107 CEST	80	50539	210.157.78.4	192.168.2.4
Oct 9, 2024 16:29:16.946649075 CEST	80	50539	210.157.78.4	192.168.2.4
Oct 9, 2024 16:29:16.946731091 CEST	80	50539	210.157.78.4	192.168.2.4
Oct 9, 2024 16:29:16.946754932 CEST	50539	80	192.168.2.4	210.157.78.4
Oct 9, 2024 16:29:16.946800947 CEST	50539	80	192.168.2.4	210.157.78.4
Oct 9, 2024 16:29:16.946847916 CEST	50539	80	192.168.2.4	210.157.78.4
Oct 9, 2024 16:29:16.951689005 CEST	80	50539	210.157.78.4	192.168.2.4
Oct 9, 2024 16:29:17.155118942 CEST	50540	80	192.168.2.4	185.111.247.38
Oct 9, 2024 16:29:17.159955025 CEST	80	50540	185.111.247.38	192.168.2.4
Oct 9, 2024 16:29:17.160058975 CEST	50540	80	192.168.2.4	185.111.247.38
Oct 9, 2024 16:29:17.160094023 CEST	50540	80	192.168.2.4	185.111.247.38
Oct 9, 2024 16:29:17.164926052 CEST	80	50540	185.111.247.38	192.168.2.4
Oct 9, 2024 16:29:17.945862055 CEST	80	50540	185.111.247.38	192.168.2.4
Oct 9, 2024 16:29:17.946409941 CEST	80	50540	185.111.247.38	192.168.2.4
Oct 9, 2024 16:29:17.946542978 CEST	50540	80	192.168.2.4	185.111.247.38
Oct 9, 2024 16:29:17.947199106 CEST	50540	80	192.168.2.4	185.111.247.38
Oct 9, 2024 16:29:17.952038050 CEST	80	50540	185.111.247.38	192.168.2.4
Oct 9, 2024 16:29:19.791923046 CEST	50541	80	192.168.2.4	162.43.112.11
Oct 9, 2024 16:29:19.796775103 CEST	80	50541	162.43.112.11	192.168.2.4
Oct 9, 2024 16:29:19.796879053 CEST	50541	80	192.168.2.4	162.43.112.11
Oct 9, 2024 16:29:19.796945095 CEST	50541	80	192.168.2.4	162.43.112.11
Oct 9, 2024 16:29:19.802078962 CEST	80	50541	162.43.112.11	192.168.2.4
Oct 9, 2024 16:29:20.620116949 CEST	80	50541	162.43.112.11	192.168.2.4
Oct 9, 2024 16:29:20.620131969 CEST	80	50541	162.43.112.11	192.168.2.4
Oct 9, 2024 16:29:20.620270967 CEST	50541	80	192.168.2.4	162.43.112.11
Oct 9, 2024 16:29:20.620364904 CEST	50541	80	192.168.2.4	162.43.112.11
Oct 9, 2024 16:29:20.620685101 CEST	80	50541	162.43.112.11	192.168.2.4
Oct 9, 2024 16:29:20.620696068 CEST	80	50541	162.43.112.11	192.168.2.4
Oct 9, 2024 16:29:20.620706081 CEST	80	50541	162.43.112.11	192.168.2.4
Oct 9, 2024 16:29:20.620718002 CEST	80	50541	162.43.112.11	192.168.2.4
Oct 9, 2024 16:29:20.620728016 CEST	80	50541	162.43.112.11	192.168.2.4
Oct 9, 2024 16:29:20.620738029 CEST	80	50541	162.43.112.11	192.168.2.4
Oct 9, 2024 16:29:20.620747089 CEST	50541	80	192.168.2.4	162.43.112.11
Oct 9, 2024 16:29:20.620747089 CEST	80	50541	162.43.112.11	192.168.2.4
Oct 9, 2024 16:29:20.620776892 CEST	50541	80	192.168.2.4	162.43.112.11
Oct 9, 2024 16:29:20.620857000 CEST	50541	80	192.168.2.4	162.43.112.11
Oct 9, 2024 16:29:20.620857000 CEST	50541	80	192.168.2.4	162.43.112.11
Oct 9, 2024 16:29:20.769556999 CEST	50542	80	192.168.2.4	103.169.142.0
Oct 9, 2024 16:29:20.774707079 CEST	80	50542	103.169.142.0	192.168.2.4
Oct 9, 2024 16:29:20.774785995 CEST	50542	80	192.168.2.4	103.169.142.0
Oct 9, 2024 16:29:20.774899006 CEST	50542	80	192.168.2.4	103.169.142.0
Oct 9, 2024 16:29:20.780941010 CEST	80	50542	103.169.142.0	192.168.2.4
Oct 9, 2024 16:29:21.270524979 CEST	80	50542	103.169.142.0	192.168.2.4
Oct 9, 2024 16:29:21.271043062 CEST	80	50542	103.169.142.0	192.168.2.4
Oct 9, 2024 16:29:21.271214008 CEST	50542	80	192.168.2.4	103.169.142.0
Oct 9, 2024 16:29:21.271456957 CEST	50542	80	192.168.2.4	103.169.142.0
Oct 9, 2024 16:29:21.276277065 CEST	80	50542	103.169.142.0	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 9, 2024 16:27:19.516779900 CEST	61941	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:19.527856112 CEST	53	61941	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:19.531312943 CEST	59355	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:19.561629057 CEST	53	59355	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:19.562501907 CEST	51063	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:19.574085951 CEST	53	51063	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:19.574801922 CEST	57661	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:19.734438896 CEST	53	57661	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:19.735336065 CEST	56423	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:19.746433020 CEST	53	56423	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:19.747323990 CEST	57009	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:19.757493019 CEST	53	57009	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:19.758184910 CEST	56691	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:19.920655966 CEST	53	56691	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:19.921585083 CEST	64196	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:19.933198929 CEST	53	64196	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:19.934508085 CEST	52285	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:19.971004963 CEST	53	52285	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:19.972060919 CEST	50786	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.006871939 CEST	53	50786	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.008004904 CEST	60971	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.018081903 CEST	53	60971	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.018795967 CEST	52853	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.030225992 CEST	53	52853	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.030915976 CEST	53051	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.043037891 CEST	53	53051	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.043966055 CEST	53715	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.056407928 CEST	53	53715	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.057239056 CEST	59360	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.089106083 CEST	53	59360	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.089884043 CEST	57398	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.246536016 CEST	53	57398	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.247622013 CEST	53227	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.258868933 CEST	53	53227	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.259604931 CEST	54959	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.273937941 CEST	53	54959	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.275055885 CEST	50629	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.436639071 CEST	53	50629	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.437762022 CEST	51450	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.449105978 CEST	53	51450	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.450565100 CEST	54653	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.489624023 CEST	53	54653	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.510144949 CEST	60054	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.519696951 CEST	53	60054	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.520840883 CEST	62146	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.531131029 CEST	53	62146	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.531982899 CEST	54218	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.541373968 CEST	53	54218	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.556469917 CEST	60562	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.568809032 CEST	53	60562	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.569866896 CEST	56789	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.606996059 CEST	53	56789	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.608042955 CEST	57995	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.617621899 CEST	53	57995	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.618505955 CEST	64195	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.629333019 CEST	53	64195	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.630342007 CEST	51184	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.660881996 CEST	53	51184	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.661987066 CEST	58374	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.693945885 CEST	53	58374	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.695133924 CEST	64396	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.729154110 CEST	53	64396	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.730473995 CEST	59941	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.740480900 CEST	53	59941	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.741391897 CEST	54627	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.752187014 CEST	53	54627	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.753055096 CEST	53450	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.785155058 CEST	53	53450	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.786128044 CEST	49694	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.797343016 CEST	53	49694	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.798145056 CEST	53478	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.810630083 CEST	53	53478	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.815977097 CEST	58251	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.828193903 CEST	53	58251	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.834475040 CEST	58804	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.844763041 CEST	53	58804	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.845772028 CEST	54097	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.856390953 CEST	53	54097	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.857348919 CEST	61730	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.867223978 CEST	53	61730	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.868077993 CEST	64173	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.879070044 CEST	53	64173	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.879926920 CEST	49846	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.889914989 CEST	53	49846	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.890707016 CEST	62941	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.900331020 CEST	53	62941	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.901159048 CEST	58067	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.910808086 CEST	53	58067	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.911710978 CEST	49733	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.944013119 CEST	53	49733	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.945015907 CEST	61458	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.955724955 CEST	53	61458	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.956698895 CEST	61964	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:20.966531992 CEST	53	61964	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:20.967694998 CEST	51307	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:21.003036022 CEST	53	51307	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:21.004026890 CEST	56889	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:21.014677048 CEST	53	56889	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:21.015603065 CEST	61555	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:21.027364016 CEST	53	61555	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:21.028099060 CEST	62274	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:21.334398985 CEST	53	62274	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:22.077691078 CEST	65176	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:22.088501930 CEST	53	65176	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:22.196002960 CEST	60459	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:22.205935001 CEST	53	60459	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:22.238352060 CEST	59772	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:22.249794960 CEST	53	59772	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:22.251591921 CEST	54487	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:22.287610054 CEST	53	54487	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:22.299925089 CEST	56315	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:22.335561037 CEST	53	56315	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:22.336405039 CEST	64026	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:22.349267960 CEST	53	64026	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:22.350001097 CEST	52826	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:22.361551046 CEST	53	52826	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:22.362242937 CEST	64469	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:22.372050047 CEST	53	64469	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:22.372793913 CEST	56737	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:22.384140968 CEST	53	56737	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:22.384919882 CEST	63870	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:22.391804934 CEST	53	63870	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:22.979942083 CEST	53739	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:23.013911009 CEST	53	53739	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:23.014858961 CEST	57937	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:23.316359043 CEST	53	57937	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:24.082600117 CEST	56342	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:24.093738079 CEST	53	56342	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:24.094624043 CEST	63392	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:24.105087996 CEST	53	63392	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:24.105887890 CEST	64200	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:24.138032913 CEST	53	64200	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:24.139014006 CEST	57895	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:24.150547981 CEST	53	57895	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:24.151319981 CEST	56138	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:24.161535978 CEST	53	56138	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:24.162302017 CEST	58773	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:24.172763109 CEST	53	58773	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:24.173535109 CEST	61875	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:24.208744049 CEST	53	61875	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:24.209558964 CEST	53255	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:24.458004951 CEST	53	53255	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:24.952764034 CEST	57104	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:24.988768101 CEST	53	57104	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:24.989763021 CEST	51746	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:25.026707888 CEST	53	51746	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:25.027842045 CEST	55173	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:25.038799047 CEST	53	55173	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:25.039743900 CEST	49947	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:25.072815895 CEST	53	49947	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:25.074039936 CEST	64087	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:25.108537912 CEST	53	64087	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:25.109370947 CEST	51410	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:25.120690107 CEST	53	51410	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:25.121642113 CEST	61681	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:25.132929087 CEST	53	61681	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:25.133902073 CEST	57180	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:25.170883894 CEST	53	57180	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:25.171716928 CEST	53164	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:25.203480959 CEST	53	53164	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:25.204298973 CEST	63976	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:25.215326071 CEST	53	63976	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:25.215955019 CEST	58433	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:25.585125923 CEST	53	58433	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:26.079288960 CEST	65409	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:26.090936899 CEST	53	65409	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:26.091600895 CEST	50198	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:26.126622915 CEST	53	50198	1.1.1.1	192.168.2.4
Oct 9, 2024 16:27:26.127366066 CEST	56458	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:27:26.286885977 CEST	53	56458	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:37.993954897 CEST	55990	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.004633904 CEST	53	55990	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.006066084 CEST	52114	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.016480923 CEST	53	52114	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.017419100 CEST	49664	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.055171967 CEST	53	49664	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.056036949 CEST	63527	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.088315010 CEST	53	63527	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.089124918 CEST	61044	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.098994017 CEST	53	61044	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.099972010 CEST	55251	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.110034943 CEST	53	55251	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.110805035 CEST	55602	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.120608091 CEST	53	55602	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.121339083 CEST	58072	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.157426119 CEST	53	58072	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.158185959 CEST	62799	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.190680027 CEST	53	62799	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.196866989 CEST	63819	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.207247972 CEST	53	63819	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.207973003 CEST	56608	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.244110107 CEST	53	56608	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.244837999 CEST	59810	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.277769089 CEST	53	59810	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.278652906 CEST	49503	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.314943075 CEST	53	49503	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.315885067 CEST	51940	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.327742100 CEST	53	51940	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.328418016 CEST	54449	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.338877916 CEST	53	54449	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.339791059 CEST	52796	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.350084066 CEST	53	52796	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.350853920 CEST	54307	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.363928080 CEST	53	54307	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.365109921 CEST	50476	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.375638008 CEST	53	50476	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.376214027 CEST	55734	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.387729883 CEST	53	55734	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.391582012 CEST	51494	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.429469109 CEST	53	51494	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.430212975 CEST	56011	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.441629887 CEST	53	56011	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.442250967 CEST	61119	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.480144024 CEST	53	61119	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.480808020 CEST	51295	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.491015911 CEST	53	51295	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.491524935 CEST	53157	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.537239075 CEST	53	53157	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.537882090 CEST	63640	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.571970940 CEST	53	63640	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.572726965 CEST	56733	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.585814953 CEST	53	56733	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.586481094 CEST	53229	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.597059965 CEST	53	53229	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.597604036 CEST	53425	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.628814936 CEST	53	53425	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.632293940 CEST	60453	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.643729925 CEST	53	60453	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.647057056 CEST	53749	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.657965899 CEST	53	53749	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.658596039 CEST	58428	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.689198017 CEST	53	58428	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.689930916 CEST	49934	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.700522900 CEST	53	49934	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.701143980 CEST	64230	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.732482910 CEST	53	64230	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.733052969 CEST	61554	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.745174885 CEST	53	61554	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.745862961 CEST	63011	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.755985975 CEST	53	63011	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.756489992 CEST	59585	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.791457891 CEST	53	59585	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.792079926 CEST	51341	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.803268909 CEST	53	51341	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.803879976 CEST	63723	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.814083099 CEST	53	63723	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.814551115 CEST	55449	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.823860884 CEST	53	55449	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.827183962 CEST	49568	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.857599020 CEST	53	49568	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.858237028 CEST	58402	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.867928028 CEST	53	58402	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.868393898 CEST	60062	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.899880886 CEST	53	60062	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.900420904 CEST	53728	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.911711931 CEST	53	53728	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.912178040 CEST	57980	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.948250055 CEST	53	57980	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.948949099 CEST	64430	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:38.983983040 CEST	53	64430	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:38.991837025 CEST	54053	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:39.004292011 CEST	53	54053	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:39.005136013 CEST	49924	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:39.037817955 CEST	53	49924	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:39.038546085 CEST	62621	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:39.048391104 CEST	53	62621	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:39.051104069 CEST	52355	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:39.061547995 CEST	53	52355	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:39.806246042 CEST	62263	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:39.817190886 CEST	53	62263	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:39.817807913 CEST	63311	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:39.830588102 CEST	53	63311	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:39.831223011 CEST	53848	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:39.862406015 CEST	53	53848	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:39.863138914 CEST	51812	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:39.900032997 CEST	53	51812	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:39.901038885 CEST	54192	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:40.074608088 CEST	53	54192	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:40.078418970 CEST	54156	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:40.089221954 CEST	53	54156	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:40.090159893 CEST	52543	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:40.100800991 CEST	53	52543	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:40.101592064 CEST	60482	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:40.136728048 CEST	53	60482	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:40.137651920 CEST	52714	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:40.171176910 CEST	53	52714	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:40.171984911 CEST	59080	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:40.183373928 CEST	53	59080	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:40.184310913 CEST	51173	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:40.196278095 CEST	53	51173	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:41.883141994 CEST	52534	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:41.895571947 CEST	53	52534	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:41.896352053 CEST	49328	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:41.906969070 CEST	53	49328	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:41.907553911 CEST	61904	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:41.918786049 CEST	53	61904	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:41.919334888 CEST	64226	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:41.930389881 CEST	53	64226	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:41.930860043 CEST	61904	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:41.940535069 CEST	53	61904	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:41.940958023 CEST	64488	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:41.951064110 CEST	53	64488	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:41.951509953 CEST	57113	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:41.963449955 CEST	53	57113	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:41.963893890 CEST	64357	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:42.247931004 CEST	53	64357	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:42.736462116 CEST	65030	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:42.774539948 CEST	53	65030	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:42.806479931 CEST	54692	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:42.817284107 CEST	53	54692	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:42.818005085 CEST	59547	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:42.854537010 CEST	53	59547	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:42.855407000 CEST	64874	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:42.866115093 CEST	53	64874	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:42.866703987 CEST	51228	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:42.876334906 CEST	53	51228	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:42.876897097 CEST	51014	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:42.886713982 CEST	53	51014	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:42.887198925 CEST	57354	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:42.897685051 CEST	53	57354	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:42.898111105 CEST	53832	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:42.907331944 CEST	53	53832	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:42.907752991 CEST	49639	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:42.918814898 CEST	53	49639	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:42.922497034 CEST	63582	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:42.932874918 CEST	53	63582	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:43.451173067 CEST	52135	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:43.462270021 CEST	53	52135	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:43.463161945 CEST	51352	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:43.473649025 CEST	53	51352	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:43.476371050 CEST	61719	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:43.487142086 CEST	53	61719	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:43.488023996 CEST	55007	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:43.499075890 CEST	53	55007	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:48.001596928 CEST	56971	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:48.843338966 CEST	53	56971	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:48.854223013 CEST	62896	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:48.888653040 CEST	53	62896	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:48.889447927 CEST	54327	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:48.923321009 CEST	53	54327	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:48.923985004 CEST	60597	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:48.933897018 CEST	53	60597	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:48.934484959 CEST	57186	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:48.946746111 CEST	53	57186	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:48.947788954 CEST	62767	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:48.958240986 CEST	53	62767	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:48.958836079 CEST	64479	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:48.989178896 CEST	53	64479	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:48.989988089 CEST	64914	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.026511908 CEST	53	64914	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.027486086 CEST	54676	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.039850950 CEST	53	54676	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.040524960 CEST	55141	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.050618887 CEST	53	55141	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.055988073 CEST	52687	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.086251020 CEST	53	52687	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.087034941 CEST	50492	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.097558022 CEST	53	50492	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.098185062 CEST	49276	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.109061003 CEST	53	49276	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.109577894 CEST	51708	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.120160103 CEST	53	51708	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.120659113 CEST	57321	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.152117014 CEST	53	57321	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.152837038 CEST	61371	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.184545040 CEST	53	61371	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.185285091 CEST	49514	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.216222048 CEST	53	49514	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.217061996 CEST	58300	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.227883101 CEST	53	58300	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.228539944 CEST	55620	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.264081955 CEST	53	55620	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.267565012 CEST	63818	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.425395012 CEST	53	63818	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.426358938 CEST	50241	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.436055899 CEST	53	50241	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.436914921 CEST	50186	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.467691898 CEST	53	50186	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.468617916 CEST	52475	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.643107891 CEST	53	52475	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.651936054 CEST	52866	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.685338974 CEST	53	52866	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.686256886 CEST	62334	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.716875076 CEST	53	62334	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.717879057 CEST	57392	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.748224020 CEST	53	57392	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.749293089 CEST	60970	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.761845112 CEST	53	60970	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.762573957 CEST	59528	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.772380114 CEST	53	59528	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.773029089 CEST	59018	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.808579922 CEST	53	59018	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.812081099 CEST	64200	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.822535038 CEST	53	64200	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.823195934 CEST	62248	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.854978085 CEST	53	62248	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.855890036 CEST	62216	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.866723061 CEST	53	62216	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.867412090 CEST	65105	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.900227070 CEST	53	65105	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.901086092 CEST	62148	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.910893917 CEST	53	62148	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.911411047 CEST	57605	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:49.921144009 CEST	53	57605	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:49.921684980 CEST	52224	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:50.085330963 CEST	53	52224	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:50.089553118 CEST	62771	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:50.100657940 CEST	53	62771	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:50.101433992 CEST	64266	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:50.132741928 CEST	53	64266	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:50.133475065 CEST	55724	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:50.143801928 CEST	53	55724	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:50.144453049 CEST	56356	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:50.180759907 CEST	53	56356	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:50.930644035 CEST	49212	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:50.942312956 CEST	53	49212	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:50.943070889 CEST	51039	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:50.976795912 CEST	53	51039	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:50.977674007 CEST	62216	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:51.015235901 CEST	53	62216	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:51.021091938 CEST	56174	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:51.030980110 CEST	53	56174	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:51.032116890 CEST	55269	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:51.044868946 CEST	53	55269	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:51.045605898 CEST	60063	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:51.057543039 CEST	53	60063	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:51.058173895 CEST	53157	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:51.068634033 CEST	53	53157	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:51.069360018 CEST	61220	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:51.101561069 CEST	53	61220	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:51.102425098 CEST	58608	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:51.112865925 CEST	53	58608	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:51.113454103 CEST	64313	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:51.123789072 CEST	53	64313	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:51.127826929 CEST	62761	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:51.290184021 CEST	53	62761	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:52.060669899 CEST	53085	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:52.071948051 CEST	53	53085	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:52.072778940 CEST	58055	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:52.103987932 CEST	53	58055	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:52.104943991 CEST	49279	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:52.119075060 CEST	53	49279	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:52.119798899 CEST	49961	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:52.130049944 CEST	53	49961	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:52.130829096 CEST	50475	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:52.141549110 CEST	53	50475	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:52.142100096 CEST	61126	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:52.154079914 CEST	53	61126	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:52.154695034 CEST	56129	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:52.167140007 CEST	53	56129	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:52.636826992 CEST	53552	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:52.646266937 CEST	53	53552	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:52.646853924 CEST	58519	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:52.679728031 CEST	53	58519	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:52.680470943 CEST	60789	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:52.852741957 CEST	53	60789	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:52.857144117 CEST	52706	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:52.868295908 CEST	53	52706	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:52.868947983 CEST	64468	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:52.879282951 CEST	53	64468	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:52.879986048 CEST	51762	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:52.890888929 CEST	53	51762	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:52.891566992 CEST	49461	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:52.904325008 CEST	53	49461	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:52.905175924 CEST	50627	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:52.918318987 CEST	53	50627	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:52.918977022 CEST	60629	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:53.079493999 CEST	53	60629	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:53.087464094 CEST	57840	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:53.119944096 CEST	53	57840	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:53.597723961 CEST	60614	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:53.634460926 CEST	53	60614	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:53.638063908 CEST	49978	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:53.807913065 CEST	53	49978	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:53.812527895 CEST	63591	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:53.848771095 CEST	53	63591	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:53.853123903 CEST	63728	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:53.863404989 CEST	53	63728	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:53.864958048 CEST	55518	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:53.874034882 CEST	53	55518	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:53.876970053 CEST	56221	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:53.886977911 CEST	53	56221	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:53.889244080 CEST	50346	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:53.920269966 CEST	53	50346	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:53.921112061 CEST	57796	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:53.932507038 CEST	53	57796	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:53.933155060 CEST	60913	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:53.966643095 CEST	53	60913	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:53.972115993 CEST	58181	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:53.982570887 CEST	53	58181	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:53.984925032 CEST	56093	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:54.020387888 CEST	53	56093	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:54.025049925 CEST	58067	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:54.546838999 CEST	53	58067	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:55.367155075 CEST	56987	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:55.402309895 CEST	53	56987	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:59.899302959 CEST	51123	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:59.911128998 CEST	53	51123	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:59.912348986 CEST	64440	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:59.923584938 CEST	53	64440	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:59.925046921 CEST	62471	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:59.935820103 CEST	53	62471	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:59.936834097 CEST	55623	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:59.947812080 CEST	53	55623	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:59.948684931 CEST	60744	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:59.958518028 CEST	53	60744	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:59.959500074 CEST	64020	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:28:59.992185116 CEST	53	64020	1.1.1.1	192.168.2.4
Oct 9, 2024 16:28:59.993506908 CEST	50404	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:00.003770113 CEST	53	50404	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:00.004918098 CEST	64839	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:00.014816046 CEST	53	64839	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:00.015755892 CEST	50827	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:00.026364088 CEST	53	50827	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:00.027241945 CEST	63442	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:00.037784100 CEST	53	63442	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:00.038592100 CEST	57913	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:00.076275110 CEST	53	57913	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:00.077203989 CEST	52200	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:00.089154005 CEST	53	52200	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:00.090075970 CEST	49893	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:00.125044107 CEST	53	49893	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:00.129482031 CEST	49309	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:00.164529085 CEST	53	49309	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:00.165893078 CEST	64474	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:00.176084042 CEST	53	64474	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:00.176935911 CEST	53574	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:00.208859921 CEST	53	53574	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:00.210042953 CEST	54937	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:00.220822096 CEST	53	54937	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:00.221658945 CEST	53281	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:00.255624056 CEST	53	53281	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:00.256648064 CEST	57736	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:00.267288923 CEST	53	57736	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:00.268263102 CEST	63672	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:00.299108028 CEST	53	63672	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:00.300503016 CEST	57268	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:00.331990004 CEST	53	57268	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:00.342367887 CEST	63189	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:00.377178907 CEST	53	63189	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:00.378211021 CEST	59764	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:00.389302015 CEST	53	59764	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:00.390578032 CEST	56392	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:00.424264908 CEST	53	56392	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:00.425767899 CEST	61601	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:00.437735081 CEST	53	61601	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:00.440681934 CEST	50025	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:00.599642992 CEST	53	50025	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:00.603914976 CEST	56408	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:00.615637064 CEST	53	56408	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:00.616687059 CEST	50516	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:00.650736094 CEST	53	50516	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:00.651870012 CEST	54853	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:00.663043022 CEST	53	54853	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:00.664299965 CEST	49685	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:00.676719904 CEST	53	49685	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:01.406511068 CEST	62196	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:01.417331934 CEST	53	62196	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:01.418373108 CEST	64266	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:01.431292057 CEST	53	64266	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:01.432106972 CEST	57169	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:01.441975117 CEST	53	57169	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:01.442657948 CEST	56472	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:01.481990099 CEST	53	56472	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:01.482920885 CEST	56177	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:01.494277954 CEST	53	56177	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:01.494978905 CEST	65005	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:01.531297922 CEST	53	65005	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:01.532474995 CEST	58599	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:01.547818899 CEST	53	58599	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:01.553025961 CEST	55278	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:01.584518909 CEST	53	55278	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:01.585407019 CEST	57990	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:01.625305891 CEST	53	57990	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:01.626166105 CEST	60459	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:01.638153076 CEST	53	60459	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:01.639326096 CEST	65233	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:01.651551962 CEST	53	65233	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:02.390908957 CEST	60047	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:02.402667999 CEST	53	60047	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:02.403575897 CEST	64909	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:02.417562962 CEST	53	64909	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:02.418628931 CEST	51410	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:02.429759026 CEST	53	51410	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:02.430529118 CEST	51345	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:02.441572905 CEST	53	51345	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:02.442358017 CEST	61394	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:02.453607082 CEST	53	61394	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:02.454374075 CEST	64650	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:02.493717909 CEST	53	64650	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:02.494996071 CEST	59471	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:02.529685974 CEST	53	59471	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:03.005268097 CEST	57032	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:03.015990973 CEST	53	57032	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:03.016858101 CEST	61469	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:03.048245907 CEST	53	61469	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:03.049423933 CEST	59430	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:03.083533049 CEST	53	59430	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:03.084852934 CEST	59496	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:03.416898012 CEST	53	59496	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:03.423418999 CEST	62863	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:03.434756994 CEST	53	62863	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:03.435570002 CEST	59904	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:03.468475103 CEST	53	59904	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:03.469778061 CEST	58740	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:03.499856949 CEST	53	58740	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:03.500888109 CEST	57658	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:03.510364056 CEST	53	57658	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:03.511197090 CEST	57978	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:03.522382975 CEST	53	57978	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:03.523446083 CEST	50986	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:03.533900976 CEST	53	50986	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:04.022674084 CEST	51997	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:04.056524992 CEST	53	51997	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:04.066606045 CEST	62917	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:04.077851057 CEST	53	62917	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:04.095402956 CEST	57763	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:04.106250048 CEST	53	57763	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:04.123997927 CEST	62356	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:04.135023117 CEST	53	62356	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:04.143624067 CEST	52082	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:04.157249928 CEST	53	52082	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:04.171555996 CEST	50901	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:04.440036058 CEST	53	50901	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:04.445688963 CEST	56120	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:04.456969023 CEST	53	56120	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:04.457983017 CEST	57010	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:04.468709946 CEST	53	57010	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:04.469758034 CEST	59720	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:04.505619049 CEST	53	59720	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:04.507081985 CEST	57693	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:04.518942118 CEST	53	57693	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:04.520112038 CEST	55465	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:04.531543970 CEST	53	55465	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:05.740633965 CEST	63811	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:05.750504971 CEST	53	63811	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:05.751374006 CEST	50780	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:05.762093067 CEST	53	50780	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:05.763233900 CEST	63785	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:05.773885012 CEST	53	63785	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:05.774877071 CEST	53401	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:05.785048962 CEST	53	53401	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:05.785741091 CEST	63052	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:05.817622900 CEST	53	63052	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:05.819062948 CEST	63116	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:05.828694105 CEST	53	63116	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:05.829627037 CEST	54488	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:05.862397909 CEST	53	54488	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:05.863675117 CEST	58460	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:05.996939898 CEST	53	58460	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:06.838347912 CEST	55467	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:06.848793983 CEST	53	55467	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:06.849705935 CEST	63701	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:06.886691093 CEST	53	63701	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:06.887917995 CEST	54079	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:06.898998022 CEST	53	54079	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:11.400937080 CEST	63004	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:11.411957979 CEST	53	63004	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:11.413108110 CEST	63672	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:11.423286915 CEST	53	63672	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:11.424807072 CEST	60757	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:11.435648918 CEST	53	60757	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:11.445004940 CEST	60650	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:11.464720964 CEST	53	60650	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:11.468688965 CEST	53731	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:11.479769945 CEST	53	53731	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:11.482681036 CEST	64650	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:11.515147924 CEST	53	64650	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:11.517842054 CEST	62099	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:11.550947905 CEST	53	62099	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:11.552419901 CEST	64691	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:11.563805103 CEST	53	64691	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:11.565327883 CEST	65530	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:11.576072931 CEST	53	65530	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:11.579281092 CEST	60018	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:11.588906050 CEST	53	60018	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:11.589524984 CEST	51982	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:11.599961996 CEST	53	51982	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:11.601031065 CEST	50480	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:11.612886906 CEST	53	50480	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:11.613718987 CEST	52717	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:11.649171114 CEST	53	52717	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:11.650187016 CEST	62691	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:11.662306070 CEST	53	62691	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:11.663081884 CEST	57559	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:11.836005926 CEST	53	57559	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:11.840517044 CEST	58344	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:11.871547937 CEST	53	58344	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:11.872570992 CEST	50869	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:11.904134035 CEST	53	50869	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:11.905157089 CEST	51691	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:12.065608025 CEST	53	51691	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:12.069288969 CEST	51145	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:12.079703093 CEST	53	51145	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:13.046837091 CEST	53248	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:13.056622982 CEST	53	53248	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:13.058228016 CEST	52393	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:13.067346096 CEST	53	52393	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:13.068753958 CEST	58365	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:13.104300022 CEST	53	58365	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:13.105252981 CEST	61459	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:13.116532087 CEST	53	61459	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:13.117402077 CEST	53992	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:13.150419950 CEST	53	53992	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:13.152977943 CEST	58571	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:13.162533998 CEST	53	58571	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:13.163981915 CEST	57528	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:13.173902035 CEST	53	57528	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:13.179250002 CEST	52715	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:13.193353891 CEST	53	52715	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:13.195130110 CEST	53095	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:13.206099987 CEST	53	53095	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:13.206888914 CEST	52915	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:13.216545105 CEST	53	52915	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:13.217627048 CEST	54414	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:13.229352951 CEST	53	54414	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:13.990783930 CEST	63749	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:14.002518892 CEST	53	63749	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:14.003462076 CEST	58177	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:14.039557934 CEST	53	58177	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:14.040384054 CEST	60505	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:14.050653934 CEST	53	60505	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:14.051424026 CEST	61509	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:14.061521053 CEST	53	61509	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:14.062097073 CEST	56039	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:14.073775053 CEST	53	56039	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:14.074594975 CEST	52139	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:14.108967066 CEST	53	52139	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:14.112854958 CEST	60732	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:14.122062922 CEST	53	60732	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:14.613061905 CEST	62912	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:14.624492884 CEST	53	62912	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:14.625185966 CEST	54043	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:14.636476994 CEST	53	54043	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:14.637274981 CEST	62540	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:14.668234110 CEST	53	62540	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:14.669142962 CEST	59526	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:14.707294941 CEST	53	59526	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:14.708265066 CEST	55424	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:14.884077072 CEST	53	55424	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:14.894329071 CEST	59422	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:14.908761024 CEST	53	59422	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:14.909496069 CEST	55430	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:14.943896055 CEST	53	55430	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:14.944947958 CEST	65116	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:14.955274105 CEST	53	65116	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:14.956145048 CEST	51404	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:14.965862036 CEST	53	51404	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:14.966546059 CEST	59829	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:15.002609015 CEST	53	59829	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:15.497071981 CEST	52740	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:15.508517981 CEST	53	52740	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:15.509433031 CEST	57841	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:15.543019056 CEST	53	57841	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:15.544044018 CEST	50313	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:15.719302893 CEST	53	50313	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:15.724663019 CEST	57686	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:15.734956980 CEST	53	57686	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:15.735865116 CEST	49266	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:15.770735979 CEST	53	49266	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:15.772010088 CEST	58030	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:15.782696009 CEST	53	58030	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:15.783521891 CEST	65338	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:15.944715023 CEST	53	65338	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:15.950656891 CEST	60301	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:15.960464954 CEST	53	60301	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:15.961179972 CEST	55714	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:16.118673086 CEST	53	55714	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:16.124610901 CEST	57067	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:16.135003090 CEST	53	57067	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:16.135868073 CEST	50703	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:16.146373034 CEST	53	50703	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:16.952037096 CEST	64102	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:16.983405113 CEST	53	64102	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:16.984381914 CEST	50779	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:17.020791054 CEST	53	50779	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:17.022042036 CEST	54919	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:17.057077885 CEST	53	54919	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:17.058088064 CEST	53072	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:17.067508936 CEST	53	53072	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:17.068110943 CEST	62793	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:17.077383995 CEST	53	62793	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:17.078013897 CEST	57441	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:17.107487917 CEST	53	57441	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:17.114320993 CEST	52987	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:17.149900913 CEST	53	52987	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:17.950622082 CEST	53038	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:17.983875990 CEST	53	53038	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:17.985048056 CEST	54705	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:18.446687937 CEST	53	54705	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:18.452070951 CEST	63826	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:18.487235069 CEST	53	63826	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:18.488126993 CEST	49354	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:19.496006012 CEST	49354	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:19.791028023 CEST	53	49354	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:19.791209936 CEST	53	49354	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:20.624761105 CEST	64598	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:20.657280922 CEST	53	64598	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:20.658462048 CEST	56007	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:20.671979904 CEST	53	56007	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:20.672786951 CEST	60612	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:20.683190107 CEST	53	60612	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:20.683963060 CEST	64184	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:20.720767021 CEST	53	64184	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:20.729680061 CEST	53104	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:20.766282082 CEST	53	53104	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:21.278990984 CEST	61815	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:21.289216995 CEST	53	61815	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:21.293453932 CEST	57195	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:21.329318047 CEST	53	57195	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:21.330187082 CEST	51023	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:21.365353107 CEST	53	51023	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:21.368097067 CEST	52484	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:21.380625963 CEST	53	52484	1.1.1.1	192.168.2.4
Oct 9, 2024 16:29:21.382061958 CEST	58051	53	192.168.2.4	1.1.1.1
Oct 9, 2024 16:29:21.397382021 CEST	53	58051	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 9, 2024 16:27:19.516779900 CEST	192.168.2.4	1.1.1.1	0x95bc	Standard query (0)	glassnature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:19.531312943 CEST	192.168.2.4	1.1.1.1	0x41c7	Standard query (0)	answerneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:19.562501907 CEST	192.168.2.4	1.1.1.1	0xf528	Standard query (0)	glassneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:19.574801922 CEST	192.168.2.4	1.1.1.1	0xb96e	Standard query (0)	answerenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:19.735336065 CEST	192.168.2.4	1.1.1.1	0x667e	Standard query (0)	glassenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:19.747323990 CEST	192.168.2.4	1.1.1.1	0x6e90	Standard query (0)	answergovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:19.758184910 CEST	192.168.2.4	1.1.1.1	0x3b38	Standard query (0)	glassgovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:19.921585083 CEST	192.168.2.4	1.1.1.1	0x9a77	Standard query (0)	difficultnature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:19.934508085 CEST	192.168.2.4	1.1.1.1	0x8406	Standard query (0)	heardnature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:19.972060919 CEST	192.168.2.4	1.1.1.1	0xd791	Standard query (0)	difficultneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.008004904 CEST	192.168.2.4	1.1.1.1	0xb14c	Standard query (0)	heardneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.018795967 CEST	192.168.2.4	1.1.1.1	0x70e2	Standard query (0)	difficultenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.030915976 CEST	192.168.2.4	1.1.1.1	0xdd73	Standard query (0)	heardenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.043966055 CEST	192.168.2.4	1.1.1.1	0x2a95	Standard query (0)	difficultgovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.057239056 CEST	192.168.2.4	1.1.1.1	0x8f9	Standard query (0)	heardgovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.089884043 CEST	192.168.2.4	1.1.1.1	0x40ae	Standard query (0)	pleasantnature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.247622013 CEST	192.168.2.4	1.1.1.1	0x7294	Standard query (0)	necessarynature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.259604931 CEST	192.168.2.4	1.1.1.1	0x6cb4	Standard query (0)	pleasantneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.275055885 CEST	192.168.2.4	1.1.1.1	0x15d2	Standard query (0)	necessaryneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.437762022 CEST	192.168.2.4	1.1.1.1	0x84cd	Standard query (0)	pleasantenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.450565100 CEST	192.168.2.4	1.1.1.1	0x4ee4	Standard query (0)	necessaryenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.510144949 CEST	192.168.2.4	1.1.1.1	0xe2b9	Standard query (0)	pleasantgovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.520840883 CEST	192.168.2.4	1.1.1.1	0x8fd1	Standard query (0)	necessarygovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.531982899 CEST	192.168.2.4	1.1.1.1	0xc14	Standard query (0)	ordernature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.556469917 CEST	192.168.2.4	1.1.1.1	0xecd9	Standard query (0)	requirenature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.569866896 CEST	192.168.2.4	1.1.1.1	0x4b35	Standard query (0)	orderneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.608042955 CEST	192.168.2.4	1.1.1.1	0xc0b6	Standard query (0)	requireneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.618505955 CEST	192.168.2.4	1.1.1.1	0x2211	Standard query (0)	orderenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.630342007 CEST	192.168.2.4	1.1.1.1	0xf7d1	Standard query (0)	requireenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.661987066 CEST	192.168.2.4	1.1.1.1	0xc76	Standard query (0)	ordergovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.695133924 CEST	192.168.2.4	1.1.1.1	0x82e3	Standard query (0)	requiregovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.730473995 CEST	192.168.2.4	1.1.1.1	0x60b7	Standard query (0)	leadernature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.741391897 CEST	192.168.2.4	1.1.1.1	0x98b1	Standard query (0)	heavennature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.753055096 CEST	192.168.2.4	1.1.1.1	0xe46b	Standard query (0)	leaderneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.786128044 CEST	192.168.2.4	1.1.1.1	0xf92a	Standard query (0)	heavenneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.798145056 CEST	192.168.2.4	1.1.1.1	0xfa5d	Standard query (0)	leaderenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.815977097 CEST	192.168.2.4	1.1.1.1	0x9f48	Standard query (0)	heavenenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.834475040 CEST	192.168.2.4	1.1.1.1	0x7cb3	Standard query (0)	leadergovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.845772028 CEST	192.168.2.4	1.1.1.1	0x9c58	Standard query (0)	heavengovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.857348919 CEST	192.168.2.4	1.1.1.1	0xe8b4	Standard query (0)	heavynature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.868077993 CEST	192.168.2.4	1.1.1.1	0xf5b6	Standard query (0)	gentlenature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.879926920 CEST	192.168.2.4	1.1.1.1	0xba3	Standard query (0)	heavyneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.890707016 CEST	192.168.2.4	1.1.1.1	0xcb4	Standard query (0)	gentleneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.901159048 CEST	192.168.2.4	1.1.1.1	0xd8f9	Standard query (0)	heavyenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.911710978 CEST	192.168.2.4	1.1.1.1	0x677d	Standard query (0)	gentleenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.945015907 CEST	192.168.2.4	1.1.1.1	0xed1	Standard query (0)	heavygovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.956698895 CEST	192.168.2.4	1.1.1.1	0xcf0b	Standard query (0)	gentlegovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.967694998 CEST	192.168.2.4	1.1.1.1	0xd830	Standard query (0)	variousnature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:21.004026890 CEST	192.168.2.4	1.1.1.1	0x5735	Standard query (0)	returnnature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:21.015603065 CEST	192.168.2.4	1.1.1.1	0x9ce5	Standard query (0)	variousneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:21.028099060 CEST	192.168.2.4	1.1.1.1	0x7d88	Standard query (0)	returnneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:22.077691078 CEST	192.168.2.4	1.1.1.1	0xd73a	Standard query (0)	variousenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:22.196002960 CEST	192.168.2.4	1.1.1.1	0xfda2	Standard query (0)	returnenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:22.238352060 CEST	192.168.2.4	1.1.1.1	0xfd08	Standard query (0)	variousgovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:22.251591921 CEST	192.168.2.4	1.1.1.1	0x4ce6	Standard query (0)	returngovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:22.299925089 CEST	192.168.2.4	1.1.1.1	0xc710	Standard query (0)	degreefurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:22.336405039 CEST	192.168.2.4	1.1.1.1	0x3b74	Standard query (0)	forwardfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:22.350001097 CEST	192.168.2.4	1.1.1.1	0xdda8	Standard query (0)	degreecover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:22.362242937 CEST	192.168.2.4	1.1.1.1	0xdeeb	Standard query (0)	forwardcover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:22.372793913 CEST	192.168.2.4	1.1.1.1	0x102c	Standard query (0)	degreebecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:22.384919882 CEST	192.168.2.4	1.1.1.1	0xf726	Standard query (0)	forwardbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:22.979942083 CEST	192.168.2.4	1.1.1.1	0xd3b6	Standard query (0)	degreecompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:23.014858961 CEST	192.168.2.4	1.1.1.1	0xdcb7	Standard query (0)	forwardcompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:24.082600117 CEST	192.168.2.4	1.1.1.1	0x99f7	Standard query (0)	answerfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:24.094624043 CEST	192.168.2.4	1.1.1.1	0x6777	Standard query (0)	glassfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:24.105887890 CEST	192.168.2.4	1.1.1.1	0x821f	Standard query (0)	answercover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:24.139014006 CEST	192.168.2.4	1.1.1.1	0x7013	Standard query (0)	glasscover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:24.151319981 CEST	192.168.2.4	1.1.1.1	0x3e31	Standard query (0)	answerbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:24.162302017 CEST	192.168.2.4	1.1.1.1	0xc17b	Standard query (0)	glassbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:24.173535109 CEST	192.168.2.4	1.1.1.1	0xc05	Standard query (0)	answercompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:24.209558964 CEST	192.168.2.4	1.1.1.1	0xbb97	Standard query (0)	glasscompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:24.952764034 CEST	192.168.2.4	1.1.1.1	0xadd6	Standard query (0)	difficultfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:24.989763021 CEST	192.168.2.4	1.1.1.1	0x5a59	Standard query (0)	heardfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:25.027842045 CEST	192.168.2.4	1.1.1.1	0xae1e	Standard query (0)	difficultcover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:25.039743900 CEST	192.168.2.4	1.1.1.1	0xfa39	Standard query (0)	heardcover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:25.074039936 CEST	192.168.2.4	1.1.1.1	0xb25a	Standard query (0)	difficultbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:25.109370947 CEST	192.168.2.4	1.1.1.1	0x5e4a	Standard query (0)	heardbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:25.121642113 CEST	192.168.2.4	1.1.1.1	0x973c	Standard query (0)	difficultcompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:25.133902073 CEST	192.168.2.4	1.1.1.1	0xf294	Standard query (0)	heardcompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:25.171716928 CEST	192.168.2.4	1.1.1.1	0x1795	Standard query (0)	pleasantfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:25.204298973 CEST	192.168.2.4	1.1.1.1	0x6faa	Standard query (0)	necessaryfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:25.215955019 CEST	192.168.2.4	1.1.1.1	0xd8cb	Standard query (0)	pleasantcover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:26.079288960 CEST	192.168.2.4	1.1.1.1	0x5aea	Standard query (0)	necessarycover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:26.091600895 CEST	192.168.2.4	1.1.1.1	0x6c1f	Standard query (0)	pleasantbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:26.127366066 CEST	192.168.2.4	1.1.1.1	0xee17	Standard query (0)	necessarybecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:37.993954897 CEST	192.168.2.4	1.1.1.1	0x5611	Standard query (0)	answerneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.006066084 CEST	192.168.2.4	1.1.1.1	0x89c6	Standard query (0)	glassneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.017419100 CEST	192.168.2.4	1.1.1.1	0xc511	Standard query (0)	answerenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.056036949 CEST	192.168.2.4	1.1.1.1	0x5f52	Standard query (0)	glassenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.089124918 CEST	192.168.2.4	1.1.1.1	0x8259	Standard query (0)	answergovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.099972010 CEST	192.168.2.4	1.1.1.1	0x2e6d	Standard query (0)	glassgovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.110805035 CEST	192.168.2.4	1.1.1.1	0xd833	Standard query (0)	difficultnature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.121339083 CEST	192.168.2.4	1.1.1.1	0x201d	Standard query (0)	heardnature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.158185959 CEST	192.168.2.4	1.1.1.1	0x854e	Standard query (0)	difficultneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.196866989 CEST	192.168.2.4	1.1.1.1	0x33a5	Standard query (0)	heardneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.207973003 CEST	192.168.2.4	1.1.1.1	0x6fdd	Standard query (0)	difficultenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.244837999 CEST	192.168.2.4	1.1.1.1	0x7857	Standard query (0)	heardenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.278652906 CEST	192.168.2.4	1.1.1.1	0xab6c	Standard query (0)	difficultgovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.315885067 CEST	192.168.2.4	1.1.1.1	0x9bbf	Standard query (0)	heardgovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.328418016 CEST	192.168.2.4	1.1.1.1	0x7397	Standard query (0)	pleasantnature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.339791059 CEST	192.168.2.4	1.1.1.1	0xd5d2	Standard query (0)	necessarynature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.350853920 CEST	192.168.2.4	1.1.1.1	0xe4b3	Standard query (0)	pleasantneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.365109921 CEST	192.168.2.4	1.1.1.1	0xb371	Standard query (0)	necessaryneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.376214027 CEST	192.168.2.4	1.1.1.1	0x9f58	Standard query (0)	pleasantenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.391582012 CEST	192.168.2.4	1.1.1.1	0xcae8	Standard query (0)	necessaryenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.430212975 CEST	192.168.2.4	1.1.1.1	0x3440	Standard query (0)	pleasantgovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.442250967 CEST	192.168.2.4	1.1.1.1	0xa5de	Standard query (0)	necessarygovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.480808020 CEST	192.168.2.4	1.1.1.1	0xa8a5	Standard query (0)	ordernature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.491524935 CEST	192.168.2.4	1.1.1.1	0x454e	Standard query (0)	requirenature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.537882090 CEST	192.168.2.4	1.1.1.1	0xf663	Standard query (0)	orderneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.572726965 CEST	192.168.2.4	1.1.1.1	0x2d73	Standard query (0)	requireneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.586481094 CEST	192.168.2.4	1.1.1.1	0x847f	Standard query (0)	orderenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.597604036 CEST	192.168.2.4	1.1.1.1	0x75f7	Standard query (0)	requireenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.632293940 CEST	192.168.2.4	1.1.1.1	0x5800	Standard query (0)	ordergovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.647057056 CEST	192.168.2.4	1.1.1.1	0xe067	Standard query (0)	requiregovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.658596039 CEST	192.168.2.4	1.1.1.1	0xff4	Standard query (0)	leadernature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.689930916 CEST	192.168.2.4	1.1.1.1	0x2fc6	Standard query (0)	heavennature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.701143980 CEST	192.168.2.4	1.1.1.1	0x32ab	Standard query (0)	leaderneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.733052969 CEST	192.168.2.4	1.1.1.1	0x1704	Standard query (0)	heavenneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.745862961 CEST	192.168.2.4	1.1.1.1	0xe416	Standard query (0)	leaderenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.756489992 CEST	192.168.2.4	1.1.1.1	0x8662	Standard query (0)	heavenenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.792079926 CEST	192.168.2.4	1.1.1.1	0xe5af	Standard query (0)	leadergovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.803879976 CEST	192.168.2.4	1.1.1.1	0x6c1f	Standard query (0)	heavengovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.814551115 CEST	192.168.2.4	1.1.1.1	0xafee	Standard query (0)	heavynature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.827183962 CEST	192.168.2.4	1.1.1.1	0xec46	Standard query (0)	gentlenature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.858237028 CEST	192.168.2.4	1.1.1.1	0xc077	Standard query (0)	heavyneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.868393898 CEST	192.168.2.4	1.1.1.1	0x4e05	Standard query (0)	gentleneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.900420904 CEST	192.168.2.4	1.1.1.1	0x9742	Standard query (0)	heavyenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.912178040 CEST	192.168.2.4	1.1.1.1	0x90c0	Standard query (0)	gentleenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.948949099 CEST	192.168.2.4	1.1.1.1	0x3cee	Standard query (0)	heavygovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.991837025 CEST	192.168.2.4	1.1.1.1	0x695b	Standard query (0)	gentlegovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:39.005136013 CEST	192.168.2.4	1.1.1.1	0x1a2e	Standard query (0)	variousnature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:39.038546085 CEST	192.168.2.4	1.1.1.1	0x50cc	Standard query (0)	returnnature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:39.051104069 CEST	192.168.2.4	1.1.1.1	0xf602	Standard query (0)	variousneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:39.806246042 CEST	192.168.2.4	1.1.1.1	0x70ae	Standard query (0)	variousenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:39.817807913 CEST	192.168.2.4	1.1.1.1	0x7a50	Standard query (0)	returnenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:39.831223011 CEST	192.168.2.4	1.1.1.1	0x36f7	Standard query (0)	variousgovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:39.863138914 CEST	192.168.2.4	1.1.1.1	0xc9bf	Standard query (0)	returngovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:39.901038885 CEST	192.168.2.4	1.1.1.1	0xead9	Standard query (0)	degreefurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:40.078418970 CEST	192.168.2.4	1.1.1.1	0x9ed0	Standard query (0)	forwardfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:40.090159893 CEST	192.168.2.4	1.1.1.1	0xccf5	Standard query (0)	degreecover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:40.101592064 CEST	192.168.2.4	1.1.1.1	0x3407	Standard query (0)	forwardcover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:40.137651920 CEST	192.168.2.4	1.1.1.1	0x92a	Standard query (0)	degreebecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:40.171984911 CEST	192.168.2.4	1.1.1.1	0x84e4	Standard query (0)	forwardbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:40.184310913 CEST	192.168.2.4	1.1.1.1	0xc807	Standard query (0)	degreecompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:41.883141994 CEST	192.168.2.4	1.1.1.1	0x2c16	Standard query (0)	answerfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:41.896352053 CEST	192.168.2.4	1.1.1.1	0xe700	Standard query (0)	glassfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:41.907553911 CEST	192.168.2.4	1.1.1.1	0x541b	Standard query (0)	answercover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:41.919334888 CEST	192.168.2.4	1.1.1.1	0xe356	Standard query (0)	glasscover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:41.930860043 CEST	192.168.2.4	1.1.1.1	0x6081	Standard query (0)	answerbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:41.940958023 CEST	192.168.2.4	1.1.1.1	0x89c3	Standard query (0)	glassbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:41.951509953 CEST	192.168.2.4	1.1.1.1	0xf5cb	Standard query (0)	answercompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:41.963893890 CEST	192.168.2.4	1.1.1.1	0x3907	Standard query (0)	glasscompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:42.736462116 CEST	192.168.2.4	1.1.1.1	0x63c6	Standard query (0)	difficultfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:42.806479931 CEST	192.168.2.4	1.1.1.1	0x7d7	Standard query (0)	heardfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:42.818005085 CEST	192.168.2.4	1.1.1.1	0x25a5	Standard query (0)	difficultcover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:42.855407000 CEST	192.168.2.4	1.1.1.1	0x3c4d	Standard query (0)	heardcover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:42.866703987 CEST	192.168.2.4	1.1.1.1	0xc5d8	Standard query (0)	difficultbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:42.876897097 CEST	192.168.2.4	1.1.1.1	0xc6cc	Standard query (0)	heardbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:42.887198925 CEST	192.168.2.4	1.1.1.1	0x7769	Standard query (0)	difficultcompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:42.898111105 CEST	192.168.2.4	1.1.1.1	0xa1bf	Standard query (0)	heardcompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:42.907752991 CEST	192.168.2.4	1.1.1.1	0x289e	Standard query (0)	pleasantfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:42.922497034 CEST	192.168.2.4	1.1.1.1	0xe252	Standard query (0)	necessaryfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:43.451173067 CEST	192.168.2.4	1.1.1.1	0x8b6a	Standard query (0)	necessarycover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:43.463161945 CEST	192.168.2.4	1.1.1.1	0x724a	Standard query (0)	pleasantbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:43.476371050 CEST	192.168.2.4	1.1.1.1	0x9c1	Standard query (0)	necessarybecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:43.488023996 CEST	192.168.2.4	1.1.1.1	0x6f8e	Standard query (0)	pleasantcompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:48.001596928 CEST	192.168.2.4	1.1.1.1	0x4b27	Standard query (0)	heardneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:48.854223013 CEST	192.168.2.4	1.1.1.1	0xf477	Standard query (0)	difficultenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:48.889447927 CEST	192.168.2.4	1.1.1.1	0xb32e	Standard query (0)	heardenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:48.923985004 CEST	192.168.2.4	1.1.1.1	0x211	Standard query (0)	difficultgovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:48.934484959 CEST	192.168.2.4	1.1.1.1	0x9b7a	Standard query (0)	heardgovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:48.947788954 CEST	192.168.2.4	1.1.1.1	0x9b25	Standard query (0)	pleasantnature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:48.958836079 CEST	192.168.2.4	1.1.1.1	0x83b8	Standard query (0)	necessarynature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:48.989988089 CEST	192.168.2.4	1.1.1.1	0x5805	Standard query (0)	pleasantneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.027486086 CEST	192.168.2.4	1.1.1.1	0xa47f	Standard query (0)	necessaryneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.040524960 CEST	192.168.2.4	1.1.1.1	0x1bf2	Standard query (0)	pleasantenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.055988073 CEST	192.168.2.4	1.1.1.1	0x2759	Standard query (0)	necessaryenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.087034941 CEST	192.168.2.4	1.1.1.1	0x4f89	Standard query (0)	pleasantgovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.098185062 CEST	192.168.2.4	1.1.1.1	0x6d4f	Standard query (0)	necessarygovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.109577894 CEST	192.168.2.4	1.1.1.1	0x660	Standard query (0)	ordernature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.120659113 CEST	192.168.2.4	1.1.1.1	0xe5d7	Standard query (0)	requirenature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.152837038 CEST	192.168.2.4	1.1.1.1	0xb571	Standard query (0)	orderneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.185285091 CEST	192.168.2.4	1.1.1.1	0x72af	Standard query (0)	requireneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.217061996 CEST	192.168.2.4	1.1.1.1	0xb81a	Standard query (0)	orderenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.228539944 CEST	192.168.2.4	1.1.1.1	0xd1e5	Standard query (0)	requireenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.267565012 CEST	192.168.2.4	1.1.1.1	0xf318	Standard query (0)	ordergovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.426358938 CEST	192.168.2.4	1.1.1.1	0x9171	Standard query (0)	requiregovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.436914921 CEST	192.168.2.4	1.1.1.1	0x9803	Standard query (0)	leadernature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.468617916 CEST	192.168.2.4	1.1.1.1	0x3bef	Standard query (0)	heavennature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.651936054 CEST	192.168.2.4	1.1.1.1	0xa3cb	Standard query (0)	leaderneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.686256886 CEST	192.168.2.4	1.1.1.1	0x7e3d	Standard query (0)	heavenneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.717879057 CEST	192.168.2.4	1.1.1.1	0xe03c	Standard query (0)	leaderenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.749293089 CEST	192.168.2.4	1.1.1.1	0x5553	Standard query (0)	heavenenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.762573957 CEST	192.168.2.4	1.1.1.1	0xd0d3	Standard query (0)	leadergovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.773029089 CEST	192.168.2.4	1.1.1.1	0x64de	Standard query (0)	heavengovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.812081099 CEST	192.168.2.4	1.1.1.1	0x84b2	Standard query (0)	heavynature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.823195934 CEST	192.168.2.4	1.1.1.1	0x4b42	Standard query (0)	gentlenature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.855890036 CEST	192.168.2.4	1.1.1.1	0x3671	Standard query (0)	heavyneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.867412090 CEST	192.168.2.4	1.1.1.1	0xe003	Standard query (0)	gentleneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.901086092 CEST	192.168.2.4	1.1.1.1	0x182b	Standard query (0)	heavyenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.911411047 CEST	192.168.2.4	1.1.1.1	0x59f0	Standard query (0)	gentleenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.921684980 CEST	192.168.2.4	1.1.1.1	0x6dfc	Standard query (0)	heavygovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:50.089553118 CEST	192.168.2.4	1.1.1.1	0x613e	Standard query (0)	gentlegovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:50.101433992 CEST	192.168.2.4	1.1.1.1	0x82c7	Standard query (0)	variousnature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:50.133475065 CEST	192.168.2.4	1.1.1.1	0x9031	Standard query (0)	returnnature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:50.144453049 CEST	192.168.2.4	1.1.1.1	0x8af4	Standard query (0)	variousneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:50.930644035 CEST	192.168.2.4	1.1.1.1	0x62b1	Standard query (0)	variousenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:50.943070889 CEST	192.168.2.4	1.1.1.1	0xc7c1	Standard query (0)	returnenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:50.977674007 CEST	192.168.2.4	1.1.1.1	0xb074	Standard query (0)	variousgovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:51.021091938 CEST	192.168.2.4	1.1.1.1	0xa7f9	Standard query (0)	returngovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:51.032116890 CEST	192.168.2.4	1.1.1.1	0x4a02	Standard query (0)	degreefurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:51.045605898 CEST	192.168.2.4	1.1.1.1	0x54ff	Standard query (0)	forwardfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:51.058173895 CEST	192.168.2.4	1.1.1.1	0xd3ca	Standard query (0)	degreecover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:51.069360018 CEST	192.168.2.4	1.1.1.1	0x416f	Standard query (0)	forwardcover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:51.102425098 CEST	192.168.2.4	1.1.1.1	0x9fb9	Standard query (0)	degreebecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:51.113454103 CEST	192.168.2.4	1.1.1.1	0xe746	Standard query (0)	forwardbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:51.127826929 CEST	192.168.2.4	1.1.1.1	0x954c	Standard query (0)	degreecompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.060669899 CEST	192.168.2.4	1.1.1.1	0xb115	Standard query (0)	answerfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.072778940 CEST	192.168.2.4	1.1.1.1	0x604a	Standard query (0)	glassfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.104943991 CEST	192.168.2.4	1.1.1.1	0xb81a	Standard query (0)	answercover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.119798899 CEST	192.168.2.4	1.1.1.1	0xb57	Standard query (0)	glasscover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.130829096 CEST	192.168.2.4	1.1.1.1	0xb505	Standard query (0)	answerbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.142100096 CEST	192.168.2.4	1.1.1.1	0x8783	Standard query (0)	glassbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.154695034 CEST	192.168.2.4	1.1.1.1	0x6d55	Standard query (0)	answercompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.636826992 CEST	192.168.2.4	1.1.1.1	0xcb8e	Standard query (0)	difficultfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.646853924 CEST	192.168.2.4	1.1.1.1	0x2708	Standard query (0)	heardfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.680470943 CEST	192.168.2.4	1.1.1.1	0xd2f5	Standard query (0)	difficultcover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.857144117 CEST	192.168.2.4	1.1.1.1	0x6b1a	Standard query (0)	heardcover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.868947983 CEST	192.168.2.4	1.1.1.1	0x8b9b	Standard query (0)	difficultbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.879986048 CEST	192.168.2.4	1.1.1.1	0x1e2c	Standard query (0)	heardbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.891566992 CEST	192.168.2.4	1.1.1.1	0x7	Standard query (0)	difficultcompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.905175924 CEST	192.168.2.4	1.1.1.1	0xf2b3	Standard query (0)	heardcompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.918977022 CEST	192.168.2.4	1.1.1.1	0x67ce	Standard query (0)	pleasantfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:53.087464094 CEST	192.168.2.4	1.1.1.1	0xa48a	Standard query (0)	necessaryfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:53.597723961 CEST	192.168.2.4	1.1.1.1	0xfedf	Standard query (0)	necessarycover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:53.638063908 CEST	192.168.2.4	1.1.1.1	0xe65	Standard query (0)	pleasantbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:53.812527895 CEST	192.168.2.4	1.1.1.1	0x8355	Standard query (0)	necessarybecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:53.853123903 CEST	192.168.2.4	1.1.1.1	0x7220	Standard query (0)	pleasantcompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:53.864958048 CEST	192.168.2.4	1.1.1.1	0xc63f	Standard query (0)	necessarycompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:53.876970053 CEST	192.168.2.4	1.1.1.1	0xebbe	Standard query (0)	orderfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:53.889244080 CEST	192.168.2.4	1.1.1.1	0x9b74	Standard query (0)	requirefurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:53.921112061 CEST	192.168.2.4	1.1.1.1	0x4019	Standard query (0)	ordercover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:53.933155060 CEST	192.168.2.4	1.1.1.1	0xc3a5	Standard query (0)	requirecover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:53.972115993 CEST	192.168.2.4	1.1.1.1	0x15a3	Standard query (0)	orderbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:53.984925032 CEST	192.168.2.4	1.1.1.1	0x7d44	Standard query (0)	requirebecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:54.025049925 CEST	192.168.2.4	1.1.1.1	0x2373	Standard query (0)	ordercompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:55.367155075 CEST	192.168.2.4	1.1.1.1	0xe612	Standard query (0)	requirecompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:59.899302959 CEST	192.168.2.4	1.1.1.1	0x6b85	Standard query (0)	necessaryenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:59.912348986 CEST	192.168.2.4	1.1.1.1	0x129f	Standard query (0)	pleasantgovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:59.925046921 CEST	192.168.2.4	1.1.1.1	0xd84f	Standard query (0)	necessarygovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:59.936834097 CEST	192.168.2.4	1.1.1.1	0xa8af	Standard query (0)	ordernature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:59.948684931 CEST	192.168.2.4	1.1.1.1	0x7416	Standard query (0)	requirenature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:59.959500074 CEST	192.168.2.4	1.1.1.1	0xa6f4	Standard query (0)	orderneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:59.993506908 CEST	192.168.2.4	1.1.1.1	0x99c2	Standard query (0)	requireneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.004918098 CEST	192.168.2.4	1.1.1.1	0xb13e	Standard query (0)	orderenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.015755892 CEST	192.168.2.4	1.1.1.1	0x84b7	Standard query (0)	requireenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.027241945 CEST	192.168.2.4	1.1.1.1	0xf01a	Standard query (0)	ordergovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.038592100 CEST	192.168.2.4	1.1.1.1	0xd969	Standard query (0)	requiregovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.077203989 CEST	192.168.2.4	1.1.1.1	0xef7a	Standard query (0)	leadernature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.090075970 CEST	192.168.2.4	1.1.1.1	0x5b26	Standard query (0)	heavennature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.129482031 CEST	192.168.2.4	1.1.1.1	0xfe91	Standard query (0)	leaderneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.165893078 CEST	192.168.2.4	1.1.1.1	0xd4ed	Standard query (0)	heavenneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.176935911 CEST	192.168.2.4	1.1.1.1	0x6fba	Standard query (0)	leaderenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.210042953 CEST	192.168.2.4	1.1.1.1	0xacca	Standard query (0)	heavenenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.221658945 CEST	192.168.2.4	1.1.1.1	0x9d78	Standard query (0)	leadergovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.256648064 CEST	192.168.2.4	1.1.1.1	0x61e8	Standard query (0)	heavengovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.268263102 CEST	192.168.2.4	1.1.1.1	0x1d40	Standard query (0)	heavynature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.300503016 CEST	192.168.2.4	1.1.1.1	0x593e	Standard query (0)	gentlenature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.342367887 CEST	192.168.2.4	1.1.1.1	0x1c06	Standard query (0)	heavyneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.378211021 CEST	192.168.2.4	1.1.1.1	0x6edd	Standard query (0)	gentleneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.390578032 CEST	192.168.2.4	1.1.1.1	0xce54	Standard query (0)	heavyenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.425767899 CEST	192.168.2.4	1.1.1.1	0x38b2	Standard query (0)	gentleenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.440681934 CEST	192.168.2.4	1.1.1.1	0x1762	Standard query (0)	heavygovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.603914976 CEST	192.168.2.4	1.1.1.1	0x3644	Standard query (0)	gentlegovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.616687059 CEST	192.168.2.4	1.1.1.1	0x48f3	Standard query (0)	variousnature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.651870012 CEST	192.168.2.4	1.1.1.1	0x68b9	Standard query (0)	returnnature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.664299965 CEST	192.168.2.4	1.1.1.1	0x7603	Standard query (0)	variousneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:01.406511068 CEST	192.168.2.4	1.1.1.1	0x946	Standard query (0)	variousenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:01.418373108 CEST	192.168.2.4	1.1.1.1	0xb499	Standard query (0)	returnenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:01.432106972 CEST	192.168.2.4	1.1.1.1	0x7e04	Standard query (0)	variousgovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:01.442657948 CEST	192.168.2.4	1.1.1.1	0x5bbc	Standard query (0)	returngovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:01.482920885 CEST	192.168.2.4	1.1.1.1	0x6ccc	Standard query (0)	degreefurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:01.494978905 CEST	192.168.2.4	1.1.1.1	0xebee	Standard query (0)	forwardfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:01.532474995 CEST	192.168.2.4	1.1.1.1	0x41e9	Standard query (0)	degreecover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:01.553025961 CEST	192.168.2.4	1.1.1.1	0x8d31	Standard query (0)	forwardcover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:01.585407019 CEST	192.168.2.4	1.1.1.1	0xdda4	Standard query (0)	degreebecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:01.626166105 CEST	192.168.2.4	1.1.1.1	0x25ea	Standard query (0)	forwardbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:01.639326096 CEST	192.168.2.4	1.1.1.1	0x531d	Standard query (0)	degreecompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:02.390908957 CEST	192.168.2.4	1.1.1.1	0x9100	Standard query (0)	answerfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:02.403575897 CEST	192.168.2.4	1.1.1.1	0xf3d2	Standard query (0)	glassfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:02.418628931 CEST	192.168.2.4	1.1.1.1	0x164a	Standard query (0)	answercover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:02.430529118 CEST	192.168.2.4	1.1.1.1	0x2343	Standard query (0)	glasscover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:02.442358017 CEST	192.168.2.4	1.1.1.1	0x278f	Standard query (0)	answerbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:02.454374075 CEST	192.168.2.4	1.1.1.1	0x88bb	Standard query (0)	glassbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:02.494996071 CEST	192.168.2.4	1.1.1.1	0xbdd2	Standard query (0)	answercompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:03.005268097 CEST	192.168.2.4	1.1.1.1	0xda8c	Standard query (0)	difficultfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:03.016858101 CEST	192.168.2.4	1.1.1.1	0x9925	Standard query (0)	heardfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:03.049423933 CEST	192.168.2.4	1.1.1.1	0xa4b9	Standard query (0)	difficultcover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:03.084852934 CEST	192.168.2.4	1.1.1.1	0xfb4a	Standard query (0)	heardcover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:03.423418999 CEST	192.168.2.4	1.1.1.1	0x99	Standard query (0)	difficultbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:03.435570002 CEST	192.168.2.4	1.1.1.1	0x29c6	Standard query (0)	heardbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:03.469778061 CEST	192.168.2.4	1.1.1.1	0xceea	Standard query (0)	difficultcompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:03.500888109 CEST	192.168.2.4	1.1.1.1	0x1df1	Standard query (0)	heardcompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:03.511197090 CEST	192.168.2.4	1.1.1.1	0x8949	Standard query (0)	pleasantfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:03.523446083 CEST	192.168.2.4	1.1.1.1	0x1d9d	Standard query (0)	necessaryfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:04.022674084 CEST	192.168.2.4	1.1.1.1	0xdaab	Standard query (0)	necessarycover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:04.066606045 CEST	192.168.2.4	1.1.1.1	0x392c	Standard query (0)	pleasantbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:04.095402956 CEST	192.168.2.4	1.1.1.1	0xc621	Standard query (0)	necessarybecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:04.123997927 CEST	192.168.2.4	1.1.1.1	0x6197	Standard query (0)	pleasantcompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:04.143624067 CEST	192.168.2.4	1.1.1.1	0x3ae0	Standard query (0)	necessarycompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:04.171555996 CEST	192.168.2.4	1.1.1.1	0x656c	Standard query (0)	orderfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:04.445688963 CEST	192.168.2.4	1.1.1.1	0x8b2a	Standard query (0)	requirefurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:04.457983017 CEST	192.168.2.4	1.1.1.1	0x49fd	Standard query (0)	ordercover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:04.469758034 CEST	192.168.2.4	1.1.1.1	0xd4d7	Standard query (0)	requirecover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:04.507081985 CEST	192.168.2.4	1.1.1.1	0xcca0	Standard query (0)	orderbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:04.520112038 CEST	192.168.2.4	1.1.1.1	0x16e8	Standard query (0)	requirebecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:05.740633965 CEST	192.168.2.4	1.1.1.1	0xa57f	Standard query (0)	requirecompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:05.751374006 CEST	192.168.2.4	1.1.1.1	0x23be	Standard query (0)	leaderfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:05.763233900 CEST	192.168.2.4	1.1.1.1	0xbffb	Standard query (0)	heavenfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:05.774877071 CEST	192.168.2.4	1.1.1.1	0x62a1	Standard query (0)	leadercover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:05.785741091 CEST	192.168.2.4	1.1.1.1	0xc181	Standard query (0)	heavencover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:05.819062948 CEST	192.168.2.4	1.1.1.1	0xccc7	Standard query (0)	leaderbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:05.829627037 CEST	192.168.2.4	1.1.1.1	0x46b8	Standard query (0)	heavenbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:05.863675117 CEST	192.168.2.4	1.1.1.1	0xd77c	Standard query (0)	leadercompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:06.838347912 CEST	192.168.2.4	1.1.1.1	0x757	Standard query (0)	heavencompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:06.849705935 CEST	192.168.2.4	1.1.1.1	0xf855	Standard query (0)	heavyfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:06.887917995 CEST	192.168.2.4	1.1.1.1	0x21a7	Standard query (0)	gentlefurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.400937080 CEST	192.168.2.4	1.1.1.1	0x2853	Standard query (0)	leadernature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.413108110 CEST	192.168.2.4	1.1.1.1	0x59de	Standard query (0)	heavennature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.424807072 CEST	192.168.2.4	1.1.1.1	0x76e5	Standard query (0)	leaderneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.445004940 CEST	192.168.2.4	1.1.1.1	0x1796	Standard query (0)	heavenneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.468688965 CEST	192.168.2.4	1.1.1.1	0x2b0e	Standard query (0)	leaderenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.482681036 CEST	192.168.2.4	1.1.1.1	0x9126	Standard query (0)	heavenenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.517842054 CEST	192.168.2.4	1.1.1.1	0x40dc	Standard query (0)	leadergovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.552419901 CEST	192.168.2.4	1.1.1.1	0x61eb	Standard query (0)	heavengovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.565327883 CEST	192.168.2.4	1.1.1.1	0x17c7	Standard query (0)	heavynature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.579281092 CEST	192.168.2.4	1.1.1.1	0x9de9	Standard query (0)	gentlenature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.589524984 CEST	192.168.2.4	1.1.1.1	0xd346	Standard query (0)	heavyneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.601031065 CEST	192.168.2.4	1.1.1.1	0xf0e8	Standard query (0)	gentleneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.613718987 CEST	192.168.2.4	1.1.1.1	0x5cca	Standard query (0)	heavyenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.650187016 CEST	192.168.2.4	1.1.1.1	0xa83b	Standard query (0)	gentleenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.663081884 CEST	192.168.2.4	1.1.1.1	0x502b	Standard query (0)	heavygovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.840517044 CEST	192.168.2.4	1.1.1.1	0x32be	Standard query (0)	gentlegovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.872570992 CEST	192.168.2.4	1.1.1.1	0x7996	Standard query (0)	variousnature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.905157089 CEST	192.168.2.4	1.1.1.1	0x1cf0	Standard query (0)	returnnature.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:12.069288969 CEST	192.168.2.4	1.1.1.1	0x5a02	Standard query (0)	variousneedle.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:13.046837091 CEST	192.168.2.4	1.1.1.1	0xd1e4	Standard query (0)	variousenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:13.058228016 CEST	192.168.2.4	1.1.1.1	0xbb51	Standard query (0)	returnenough.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:13.068753958 CEST	192.168.2.4	1.1.1.1	0x3480	Standard query (0)	variousgovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:13.105252981 CEST	192.168.2.4	1.1.1.1	0x9733	Standard query (0)	returngovern.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:13.117402077 CEST	192.168.2.4	1.1.1.1	0x7b6f	Standard query (0)	degreefurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:13.152977943 CEST	192.168.2.4	1.1.1.1	0x9b9d	Standard query (0)	forwardfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:13.163981915 CEST	192.168.2.4	1.1.1.1	0x411	Standard query (0)	degreecover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:13.179250002 CEST	192.168.2.4	1.1.1.1	0x390f	Standard query (0)	forwardcover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:13.195130110 CEST	192.168.2.4	1.1.1.1	0x80e2	Standard query (0)	degreebecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:13.206888914 CEST	192.168.2.4	1.1.1.1	0x8022	Standard query (0)	forwardbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:13.217627048 CEST	192.168.2.4	1.1.1.1	0x8b2c	Standard query (0)	degreecompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:13.990783930 CEST	192.168.2.4	1.1.1.1	0xb8a3	Standard query (0)	answerfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.003462076 CEST	192.168.2.4	1.1.1.1	0xaf4b	Standard query (0)	glassfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.040384054 CEST	192.168.2.4	1.1.1.1	0x7d15	Standard query (0)	answercover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.051424026 CEST	192.168.2.4	1.1.1.1	0xda76	Standard query (0)	glasscover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.062097073 CEST	192.168.2.4	1.1.1.1	0xe338	Standard query (0)	answerbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.074594975 CEST	192.168.2.4	1.1.1.1	0x7c55	Standard query (0)	glassbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.112854958 CEST	192.168.2.4	1.1.1.1	0xc60a	Standard query (0)	answercompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.613061905 CEST	192.168.2.4	1.1.1.1	0x63b1	Standard query (0)	difficultfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.625185966 CEST	192.168.2.4	1.1.1.1	0x8c71	Standard query (0)	heardfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.637274981 CEST	192.168.2.4	1.1.1.1	0x728e	Standard query (0)	difficultcover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.669142962 CEST	192.168.2.4	1.1.1.1	0x43cc	Standard query (0)	heardcover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.708265066 CEST	192.168.2.4	1.1.1.1	0xe0c	Standard query (0)	difficultbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.894329071 CEST	192.168.2.4	1.1.1.1	0x1ff6	Standard query (0)	heardbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.909496069 CEST	192.168.2.4	1.1.1.1	0xbc9	Standard query (0)	difficultcompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.944947958 CEST	192.168.2.4	1.1.1.1	0x7505	Standard query (0)	heardcompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.956145048 CEST	192.168.2.4	1.1.1.1	0xf61e	Standard query (0)	pleasantfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.966546059 CEST	192.168.2.4	1.1.1.1	0x722b	Standard query (0)	necessaryfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:15.497071981 CEST	192.168.2.4	1.1.1.1	0x911b	Standard query (0)	necessarycover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:15.509433031 CEST	192.168.2.4	1.1.1.1	0xc3ff	Standard query (0)	pleasantbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:15.544044018 CEST	192.168.2.4	1.1.1.1	0xac29	Standard query (0)	necessarybecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:15.724663019 CEST	192.168.2.4	1.1.1.1	0x554d	Standard query (0)	pleasantcompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:15.735865116 CEST	192.168.2.4	1.1.1.1	0x681f	Standard query (0)	necessarycompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:15.772010088 CEST	192.168.2.4	1.1.1.1	0x7895	Standard query (0)	orderfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:15.783521891 CEST	192.168.2.4	1.1.1.1	0x1b77	Standard query (0)	requirefurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:15.950656891 CEST	192.168.2.4	1.1.1.1	0x1f19	Standard query (0)	ordercover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:15.961179972 CEST	192.168.2.4	1.1.1.1	0x338f	Standard query (0)	requirecover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:16.124610901 CEST	192.168.2.4	1.1.1.1	0x7e38	Standard query (0)	orderbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:16.135868073 CEST	192.168.2.4	1.1.1.1	0xe98	Standard query (0)	requirebecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:16.952037096 CEST	192.168.2.4	1.1.1.1	0x3a17	Standard query (0)	requirecompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:16.984381914 CEST	192.168.2.4	1.1.1.1	0xa3ab	Standard query (0)	leaderfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:17.022042036 CEST	192.168.2.4	1.1.1.1	0x3347	Standard query (0)	heavenfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:17.058088064 CEST	192.168.2.4	1.1.1.1	0x26fc	Standard query (0)	leadercover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:17.068110943 CEST	192.168.2.4	1.1.1.1	0x7b16	Standard query (0)	heavencover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:17.078013897 CEST	192.168.2.4	1.1.1.1	0xbaea	Standard query (0)	leaderbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:17.114320993 CEST	192.168.2.4	1.1.1.1	0xadb3	Standard query (0)	heavenbecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:17.950622082 CEST	192.168.2.4	1.1.1.1	0xd12a	Standard query (0)	heavencompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:17.985048056 CEST	192.168.2.4	1.1.1.1	0x4b42	Standard query (0)	heavyfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:18.452070951 CEST	192.168.2.4	1.1.1.1	0x8c1b	Standard query (0)	gentlefurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:18.488126993 CEST	192.168.2.4	1.1.1.1	0x7d02	Standard query (0)	heavycover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:19.496006012 CEST	192.168.2.4	1.1.1.1	0x7d02	Standard query (0)	heavycover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:20.624761105 CEST	192.168.2.4	1.1.1.1	0x4841	Standard query (0)	gentlecover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:20.658462048 CEST	192.168.2.4	1.1.1.1	0xace9	Standard query (0)	heavybecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:20.672786951 CEST	192.168.2.4	1.1.1.1	0x1ae	Standard query (0)	gentlebecome.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:20.683963060 CEST	192.168.2.4	1.1.1.1	0x2ed8	Standard query (0)	heavycompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:20.729680061 CEST	192.168.2.4	1.1.1.1	0xae89	Standard query (0)	gentlecompany.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:21.278990984 CEST	192.168.2.4	1.1.1.1	0xa934	Standard query (0)	variousfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:21.293453932 CEST	192.168.2.4	1.1.1.1	0xbcc9	Standard query (0)	returnfurther.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:21.330187082 CEST	192.168.2.4	1.1.1.1	0x95f7	Standard query (0)	variouscover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:21.368097067 CEST	192.168.2.4	1.1.1.1	0xb1aa	Standard query (0)	returncover.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:21.382061958 CEST	192.168.2.4	1.1.1.1	0x69b0	Standard query (0)	variousbecome.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 9, 2024 16:27:19.527856112 CEST	1.1.1.1	192.168.2.4	0x95bc	Name error (3)	glassnature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:19.561629057 CEST	1.1.1.1	192.168.2.4	0x41c7	Name error (3)	answerneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:19.574085951 CEST	1.1.1.1	192.168.2.4	0xf528	Name error (3)	glassneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:19.734438896 CEST	1.1.1.1	192.168.2.4	0xb96e	Name error (3)	answerenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:19.746433020 CEST	1.1.1.1	192.168.2.4	0x667e	Name error (3)	glassenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:19.757493019 CEST	1.1.1.1	192.168.2.4	0x6e90	Name error (3)	answergovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:19.920655966 CEST	1.1.1.1	192.168.2.4	0x3b38	Name error (3)	glassgovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:19.933198929 CEST	1.1.1.1	192.168.2.4	0x9a77	Name error (3)	difficultnature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:19.971004963 CEST	1.1.1.1	192.168.2.4	0x8406	Name error (3)	heardnature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.006871939 CEST	1.1.1.1	192.168.2.4	0xd791	Name error (3)	difficultneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.018081903 CEST	1.1.1.1	192.168.2.4	0xb14c	Name error (3)	heardneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.030225992 CEST	1.1.1.1	192.168.2.4	0x70e2	Name error (3)	difficultenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.043037891 CEST	1.1.1.1	192.168.2.4	0xdd73	Name error (3)	heardenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.056407928 CEST	1.1.1.1	192.168.2.4	0x2a95	Name error (3)	difficultgovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.089106083 CEST	1.1.1.1	192.168.2.4	0x8f9	Name error (3)	heardgovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.246536016 CEST	1.1.1.1	192.168.2.4	0x40ae	Name error (3)	pleasantnature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.258868933 CEST	1.1.1.1	192.168.2.4	0x7294	Name error (3)	necessarynature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.273937941 CEST	1.1.1.1	192.168.2.4	0x6cb4	Name error (3)	pleasantneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.436639071 CEST	1.1.1.1	192.168.2.4	0x15d2	Name error (3)	necessaryneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.449105978 CEST	1.1.1.1	192.168.2.4	0x84cd	Name error (3)	pleasantenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.489624023 CEST	1.1.1.1	192.168.2.4	0x4ee4	Name error (3)	necessaryenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.519696951 CEST	1.1.1.1	192.168.2.4	0xe2b9	Name error (3)	pleasantgovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.531131029 CEST	1.1.1.1	192.168.2.4	0x8fd1	Name error (3)	necessarygovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.541373968 CEST	1.1.1.1	192.168.2.4	0xc14	Name error (3)	ordernature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.568809032 CEST	1.1.1.1	192.168.2.4	0xecd9	Name error (3)	requirenature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.606996059 CEST	1.1.1.1	192.168.2.4	0x4b35	Name error (3)	orderneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.617621899 CEST	1.1.1.1	192.168.2.4	0xc0b6	Name error (3)	requireneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.629333019 CEST	1.1.1.1	192.168.2.4	0x2211	Name error (3)	orderenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.660881996 CEST	1.1.1.1	192.168.2.4	0xf7d1	Name error (3)	requireenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.693945885 CEST	1.1.1.1	192.168.2.4	0xc76	Name error (3)	ordergovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.729154110 CEST	1.1.1.1	192.168.2.4	0x82e3	Name error (3)	requiregovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.740480900 CEST	1.1.1.1	192.168.2.4	0x60b7	Name error (3)	leadernature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.752187014 CEST	1.1.1.1	192.168.2.4	0x98b1	Name error (3)	heavennature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.785155058 CEST	1.1.1.1	192.168.2.4	0xe46b	Name error (3)	leaderneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.797343016 CEST	1.1.1.1	192.168.2.4	0xf92a	Name error (3)	heavenneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.810630083 CEST	1.1.1.1	192.168.2.4	0xfa5d	Name error (3)	leaderenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.828193903 CEST	1.1.1.1	192.168.2.4	0x9f48	Name error (3)	heavenenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.844763041 CEST	1.1.1.1	192.168.2.4	0x7cb3	Name error (3)	leadergovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.856390953 CEST	1.1.1.1	192.168.2.4	0x9c58	Name error (3)	heavengovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.867223978 CEST	1.1.1.1	192.168.2.4	0xe8b4	Name error (3)	heavynature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.879070044 CEST	1.1.1.1	192.168.2.4	0xf5b6	Name error (3)	gentlenature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.889914989 CEST	1.1.1.1	192.168.2.4	0xba3	Name error (3)	heavyneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.900331020 CEST	1.1.1.1	192.168.2.4	0xcb4	Name error (3)	gentleneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.910808086 CEST	1.1.1.1	192.168.2.4	0xd8f9	Name error (3)	heavyenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.944013119 CEST	1.1.1.1	192.168.2.4	0x677d	Name error (3)	gentleenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.955724955 CEST	1.1.1.1	192.168.2.4	0xed1	Name error (3)	heavygovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:20.966531992 CEST	1.1.1.1	192.168.2.4	0xcf0b	Name error (3)	gentlegovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:21.003036022 CEST	1.1.1.1	192.168.2.4	0xd830	Name error (3)	variousnature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:21.014677048 CEST	1.1.1.1	192.168.2.4	0x5735	Name error (3)	returnnature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:21.027364016 CEST	1.1.1.1	192.168.2.4	0x9ce5	Name error (3)	variousneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:21.334398985 CEST	1.1.1.1	192.168.2.4	0x7d88	No error (0)	returnneedle.net		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:22.088501930 CEST	1.1.1.1	192.168.2.4	0xd73a	Name error (3)	variousenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:22.205935001 CEST	1.1.1.1	192.168.2.4	0xfda2	Name error (3)	returnenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:22.249794960 CEST	1.1.1.1	192.168.2.4	0xfd08	Name error (3)	variousgovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:22.287610054 CEST	1.1.1.1	192.168.2.4	0x4ce6	Name error (3)	returngovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:22.335561037 CEST	1.1.1.1	192.168.2.4	0xc710	Name error (3)	degreefurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:22.349267960 CEST	1.1.1.1	192.168.2.4	0x3b74	Name error (3)	forwardfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:22.361551046 CEST	1.1.1.1	192.168.2.4	0xdda8	Name error (3)	degreecover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:22.372050047 CEST	1.1.1.1	192.168.2.4	0xdeeb	Name error (3)	forwardcover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:22.384140968 CEST	1.1.1.1	192.168.2.4	0x102c	Name error (3)	degreebecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:23.013911009 CEST	1.1.1.1	192.168.2.4	0xd3b6	Name error (3)	degreecompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:23.316359043 CEST	1.1.1.1	192.168.2.4	0xdcb7	No error (0)	forwardcompany.net		34.218.204.173	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:24.093738079 CEST	1.1.1.1	192.168.2.4	0x99f7	Name error (3)	answerfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:24.105087996 CEST	1.1.1.1	192.168.2.4	0x6777	Name error (3)	glassfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:24.138032913 CEST	1.1.1.1	192.168.2.4	0x821f	Name error (3)	answercover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:24.150547981 CEST	1.1.1.1	192.168.2.4	0x7013	Name error (3)	glasscover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:24.161535978 CEST	1.1.1.1	192.168.2.4	0x3e31	Name error (3)	answerbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:24.172763109 CEST	1.1.1.1	192.168.2.4	0xc17b	Name error (3)	glassbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:24.208744049 CEST	1.1.1.1	192.168.2.4	0xc05	Name error (3)	answercompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:24.458004951 CEST	1.1.1.1	192.168.2.4	0xbb97	No error (0)	glasscompany.net	traff-1.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 16:27:24.458004951 CEST	1.1.1.1	192.168.2.4	0xbb97	No error (0)	traff-1.hugedomains.com	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 16:27:24.458004951 CEST	1.1.1.1	192.168.2.4	0xbb97	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		52.71.57.184	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:24.458004951 CEST	1.1.1.1	192.168.2.4	0xbb97	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		54.209.32.212	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:24.988768101 CEST	1.1.1.1	192.168.2.4	0xadd6	Name error (3)	difficultfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:25.026707888 CEST	1.1.1.1	192.168.2.4	0x5a59	Name error (3)	heardfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:25.038799047 CEST	1.1.1.1	192.168.2.4	0xae1e	Name error (3)	difficultcover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:25.072815895 CEST	1.1.1.1	192.168.2.4	0xfa39	Name error (3)	heardcover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:25.108537912 CEST	1.1.1.1	192.168.2.4	0xb25a	Name error (3)	difficultbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:25.120690107 CEST	1.1.1.1	192.168.2.4	0x5e4a	Name error (3)	heardbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:25.132929087 CEST	1.1.1.1	192.168.2.4	0x973c	Name error (3)	difficultcompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:25.170883894 CEST	1.1.1.1	192.168.2.4	0xf294	Name error (3)	heardcompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:25.203480959 CEST	1.1.1.1	192.168.2.4	0x1795	Name error (3)	pleasantfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:25.215326071 CEST	1.1.1.1	192.168.2.4	0x6faa	Name error (3)	necessaryfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:25.585125923 CEST	1.1.1.1	192.168.2.4	0xd8cb	No error (0)	pleasantcover.net	7450.bodis.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 16:27:25.585125923 CEST	1.1.1.1	192.168.2.4	0xd8cb	No error (0)	7450.bodis.com		199.59.243.227	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:26.090936899 CEST	1.1.1.1	192.168.2.4	0x5aea	Name error (3)	necessarycover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:26.126622915 CEST	1.1.1.1	192.168.2.4	0x6c1f	Name error (3)	pleasantbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:27:26.286885977 CEST	1.1.1.1	192.168.2.4	0xee17	Name error (3)	necessarybecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.004633904 CEST	1.1.1.1	192.168.2.4	0x5611	Name error (3)	answerneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.016480923 CEST	1.1.1.1	192.168.2.4	0x89c6	Name error (3)	glassneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.055171967 CEST	1.1.1.1	192.168.2.4	0xc511	Name error (3)	answerenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.088315010 CEST	1.1.1.1	192.168.2.4	0x5f52	Name error (3)	glassenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.098994017 CEST	1.1.1.1	192.168.2.4	0x8259	Name error (3)	answergovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.110034943 CEST	1.1.1.1	192.168.2.4	0x2e6d	Name error (3)	glassgovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.120608091 CEST	1.1.1.1	192.168.2.4	0xd833	Name error (3)	difficultnature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.157426119 CEST	1.1.1.1	192.168.2.4	0x201d	Name error (3)	heardnature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.190680027 CEST	1.1.1.1	192.168.2.4	0x854e	Name error (3)	difficultneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.207247972 CEST	1.1.1.1	192.168.2.4	0x33a5	Name error (3)	heardneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.244110107 CEST	1.1.1.1	192.168.2.4	0x6fdd	Name error (3)	difficultenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.277769089 CEST	1.1.1.1	192.168.2.4	0x7857	Name error (3)	heardenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.314943075 CEST	1.1.1.1	192.168.2.4	0xab6c	Name error (3)	difficultgovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.327742100 CEST	1.1.1.1	192.168.2.4	0x9bbf	Name error (3)	heardgovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.338877916 CEST	1.1.1.1	192.168.2.4	0x7397	Name error (3)	pleasantnature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.350084066 CEST	1.1.1.1	192.168.2.4	0xd5d2	Name error (3)	necessarynature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.363928080 CEST	1.1.1.1	192.168.2.4	0xe4b3	Name error (3)	pleasantneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.375638008 CEST	1.1.1.1	192.168.2.4	0xb371	Name error (3)	necessaryneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.387729883 CEST	1.1.1.1	192.168.2.4	0x9f58	Name error (3)	pleasantenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.429469109 CEST	1.1.1.1	192.168.2.4	0xcae8	Name error (3)	necessaryenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.441629887 CEST	1.1.1.1	192.168.2.4	0x3440	Name error (3)	pleasantgovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.480144024 CEST	1.1.1.1	192.168.2.4	0xa5de	Name error (3)	necessarygovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.491015911 CEST	1.1.1.1	192.168.2.4	0xa8a5	Name error (3)	ordernature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.537239075 CEST	1.1.1.1	192.168.2.4	0x454e	Name error (3)	requirenature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.571970940 CEST	1.1.1.1	192.168.2.4	0xf663	Name error (3)	orderneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.585814953 CEST	1.1.1.1	192.168.2.4	0x2d73	Name error (3)	requireneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.597059965 CEST	1.1.1.1	192.168.2.4	0x847f	Name error (3)	orderenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.628814936 CEST	1.1.1.1	192.168.2.4	0x75f7	Name error (3)	requireenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.643729925 CEST	1.1.1.1	192.168.2.4	0x5800	Name error (3)	ordergovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.657965899 CEST	1.1.1.1	192.168.2.4	0xe067	Name error (3)	requiregovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.689198017 CEST	1.1.1.1	192.168.2.4	0xff4	Name error (3)	leadernature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.700522900 CEST	1.1.1.1	192.168.2.4	0x2fc6	Name error (3)	heavennature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.732482910 CEST	1.1.1.1	192.168.2.4	0x32ab	Name error (3)	leaderneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.745174885 CEST	1.1.1.1	192.168.2.4	0x1704	Name error (3)	heavenneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.755985975 CEST	1.1.1.1	192.168.2.4	0xe416	Name error (3)	leaderenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.791457891 CEST	1.1.1.1	192.168.2.4	0x8662	Name error (3)	heavenenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.803268909 CEST	1.1.1.1	192.168.2.4	0xe5af	Name error (3)	leadergovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.814083099 CEST	1.1.1.1	192.168.2.4	0x6c1f	Name error (3)	heavengovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.823860884 CEST	1.1.1.1	192.168.2.4	0xafee	Name error (3)	heavynature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.857599020 CEST	1.1.1.1	192.168.2.4	0xec46	Name error (3)	gentlenature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.867928028 CEST	1.1.1.1	192.168.2.4	0xc077	Name error (3)	heavyneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.899880886 CEST	1.1.1.1	192.168.2.4	0x4e05	Name error (3)	gentleneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.911711931 CEST	1.1.1.1	192.168.2.4	0x9742	Name error (3)	heavyenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.948250055 CEST	1.1.1.1	192.168.2.4	0x90c0	Name error (3)	gentleenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:38.983983040 CEST	1.1.1.1	192.168.2.4	0x3cee	Name error (3)	heavygovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:39.004292011 CEST	1.1.1.1	192.168.2.4	0x695b	Name error (3)	gentlegovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:39.037817955 CEST	1.1.1.1	192.168.2.4	0x1a2e	Name error (3)	variousnature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:39.048391104 CEST	1.1.1.1	192.168.2.4	0x50cc	Name error (3)	returnnature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:39.061547995 CEST	1.1.1.1	192.168.2.4	0xf602	Name error (3)	variousneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:39.817190886 CEST	1.1.1.1	192.168.2.4	0x70ae	Name error (3)	variousenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:39.830588102 CEST	1.1.1.1	192.168.2.4	0x7a50	Name error (3)	returnenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:39.862406015 CEST	1.1.1.1	192.168.2.4	0x36f7	Name error (3)	variousgovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:39.900032997 CEST	1.1.1.1	192.168.2.4	0xc9bf	Name error (3)	returngovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:40.074608088 CEST	1.1.1.1	192.168.2.4	0xead9	Name error (3)	degreefurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:40.089221954 CEST	1.1.1.1	192.168.2.4	0x9ed0	Name error (3)	forwardfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:40.100800991 CEST	1.1.1.1	192.168.2.4	0xccf5	Name error (3)	degreecover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:40.136728048 CEST	1.1.1.1	192.168.2.4	0x3407	Name error (3)	forwardcover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:40.171176910 CEST	1.1.1.1	192.168.2.4	0x92a	Name error (3)	degreebecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:40.183373928 CEST	1.1.1.1	192.168.2.4	0x84e4	Name error (3)	forwardbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:40.196278095 CEST	1.1.1.1	192.168.2.4	0xc807	Name error (3)	degreecompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:41.895571947 CEST	1.1.1.1	192.168.2.4	0x2c16	Name error (3)	answerfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:41.906969070 CEST	1.1.1.1	192.168.2.4	0xe700	Name error (3)	glassfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:41.918786049 CEST	1.1.1.1	192.168.2.4	0x541b	Name error (3)	answercover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:41.930389881 CEST	1.1.1.1	192.168.2.4	0xe356	Name error (3)	glasscover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:41.940535069 CEST	1.1.1.1	192.168.2.4	0x6081	Name error (3)	answerbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:41.951064110 CEST	1.1.1.1	192.168.2.4	0x89c3	Name error (3)	glassbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:41.963449955 CEST	1.1.1.1	192.168.2.4	0xf5cb	Name error (3)	answercompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:42.247931004 CEST	1.1.1.1	192.168.2.4	0x3907	No error (0)	glasscompany.net	traff-1.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 16:28:42.247931004 CEST	1.1.1.1	192.168.2.4	0x3907	No error (0)	traff-1.hugedomains.com	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 16:28:42.247931004 CEST	1.1.1.1	192.168.2.4	0x3907	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		54.209.32.212	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:42.247931004 CEST	1.1.1.1	192.168.2.4	0x3907	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		52.71.57.184	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:42.774539948 CEST	1.1.1.1	192.168.2.4	0x63c6	Name error (3)	difficultfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:42.817284107 CEST	1.1.1.1	192.168.2.4	0x7d7	Name error (3)	heardfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:42.854537010 CEST	1.1.1.1	192.168.2.4	0x25a5	Name error (3)	difficultcover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:42.866115093 CEST	1.1.1.1	192.168.2.4	0x3c4d	Name error (3)	heardcover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:42.876334906 CEST	1.1.1.1	192.168.2.4	0xc5d8	Name error (3)	difficultbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:42.886713982 CEST	1.1.1.1	192.168.2.4	0xc6cc	Name error (3)	heardbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:42.897685051 CEST	1.1.1.1	192.168.2.4	0x7769	Name error (3)	difficultcompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:42.907331944 CEST	1.1.1.1	192.168.2.4	0xa1bf	Name error (3)	heardcompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:42.918814898 CEST	1.1.1.1	192.168.2.4	0x289e	Name error (3)	pleasantfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:42.932874918 CEST	1.1.1.1	192.168.2.4	0xe252	Name error (3)	necessaryfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:43.462270021 CEST	1.1.1.1	192.168.2.4	0x8b6a	Name error (3)	necessarycover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:43.473649025 CEST	1.1.1.1	192.168.2.4	0x724a	Name error (3)	pleasantbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:43.487142086 CEST	1.1.1.1	192.168.2.4	0x9c1	Name error (3)	necessarybecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:43.499075890 CEST	1.1.1.1	192.168.2.4	0x6f8e	Name error (3)	pleasantcompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:48.843338966 CEST	1.1.1.1	192.168.2.4	0x4b27	Name error (3)	heardneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:48.888653040 CEST	1.1.1.1	192.168.2.4	0xf477	Name error (3)	difficultenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:48.923321009 CEST	1.1.1.1	192.168.2.4	0xb32e	Name error (3)	heardenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:48.933897018 CEST	1.1.1.1	192.168.2.4	0x211	Name error (3)	difficultgovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:48.946746111 CEST	1.1.1.1	192.168.2.4	0x9b7a	Name error (3)	heardgovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:48.958240986 CEST	1.1.1.1	192.168.2.4	0x9b25	Name error (3)	pleasantnature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:48.989178896 CEST	1.1.1.1	192.168.2.4	0x83b8	Name error (3)	necessarynature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.026511908 CEST	1.1.1.1	192.168.2.4	0x5805	Name error (3)	pleasantneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.039850950 CEST	1.1.1.1	192.168.2.4	0xa47f	Name error (3)	necessaryneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.050618887 CEST	1.1.1.1	192.168.2.4	0x1bf2	Name error (3)	pleasantenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.086251020 CEST	1.1.1.1	192.168.2.4	0x2759	Name error (3)	necessaryenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.097558022 CEST	1.1.1.1	192.168.2.4	0x4f89	Name error (3)	pleasantgovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.109061003 CEST	1.1.1.1	192.168.2.4	0x6d4f	Name error (3)	necessarygovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.120160103 CEST	1.1.1.1	192.168.2.4	0x660	Name error (3)	ordernature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.152117014 CEST	1.1.1.1	192.168.2.4	0xe5d7	Name error (3)	requirenature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.184545040 CEST	1.1.1.1	192.168.2.4	0xb571	Name error (3)	orderneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.216222048 CEST	1.1.1.1	192.168.2.4	0x72af	Name error (3)	requireneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.227883101 CEST	1.1.1.1	192.168.2.4	0xb81a	Name error (3)	orderenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.264081955 CEST	1.1.1.1	192.168.2.4	0xd1e5	Name error (3)	requireenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.425395012 CEST	1.1.1.1	192.168.2.4	0xf318	Name error (3)	ordergovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.436055899 CEST	1.1.1.1	192.168.2.4	0x9171	Name error (3)	requiregovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.467691898 CEST	1.1.1.1	192.168.2.4	0x9803	Name error (3)	leadernature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.643107891 CEST	1.1.1.1	192.168.2.4	0x3bef	Name error (3)	heavennature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.685338974 CEST	1.1.1.1	192.168.2.4	0xa3cb	Name error (3)	leaderneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.716875076 CEST	1.1.1.1	192.168.2.4	0x7e3d	Name error (3)	heavenneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.748224020 CEST	1.1.1.1	192.168.2.4	0xe03c	Name error (3)	leaderenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.761845112 CEST	1.1.1.1	192.168.2.4	0x5553	Name error (3)	heavenenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.772380114 CEST	1.1.1.1	192.168.2.4	0xd0d3	Name error (3)	leadergovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.808579922 CEST	1.1.1.1	192.168.2.4	0x64de	Name error (3)	heavengovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.822535038 CEST	1.1.1.1	192.168.2.4	0x84b2	Name error (3)	heavynature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.854978085 CEST	1.1.1.1	192.168.2.4	0x4b42	Name error (3)	gentlenature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.866723061 CEST	1.1.1.1	192.168.2.4	0x3671	Name error (3)	heavyneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.900227070 CEST	1.1.1.1	192.168.2.4	0xe003	Name error (3)	gentleneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.910893917 CEST	1.1.1.1	192.168.2.4	0x182b	Name error (3)	heavyenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:49.921144009 CEST	1.1.1.1	192.168.2.4	0x59f0	Name error (3)	gentleenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:50.085330963 CEST	1.1.1.1	192.168.2.4	0x6dfc	Name error (3)	heavygovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:50.100657940 CEST	1.1.1.1	192.168.2.4	0x613e	Name error (3)	gentlegovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:50.132741928 CEST	1.1.1.1	192.168.2.4	0x82c7	Name error (3)	variousnature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:50.143801928 CEST	1.1.1.1	192.168.2.4	0x9031	Name error (3)	returnnature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:50.180759907 CEST	1.1.1.1	192.168.2.4	0x8af4	Name error (3)	variousneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:50.942312956 CEST	1.1.1.1	192.168.2.4	0x62b1	Name error (3)	variousenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:50.976795912 CEST	1.1.1.1	192.168.2.4	0xc7c1	Name error (3)	returnenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:51.015235901 CEST	1.1.1.1	192.168.2.4	0xb074	Name error (3)	variousgovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:51.030980110 CEST	1.1.1.1	192.168.2.4	0xa7f9	Name error (3)	returngovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:51.044868946 CEST	1.1.1.1	192.168.2.4	0x4a02	Name error (3)	degreefurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:51.057543039 CEST	1.1.1.1	192.168.2.4	0x54ff	Name error (3)	forwardfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:51.068634033 CEST	1.1.1.1	192.168.2.4	0xd3ca	Name error (3)	degreecover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:51.101561069 CEST	1.1.1.1	192.168.2.4	0x416f	Name error (3)	forwardcover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:51.112865925 CEST	1.1.1.1	192.168.2.4	0x9fb9	Name error (3)	degreebecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:51.123789072 CEST	1.1.1.1	192.168.2.4	0xe746	Name error (3)	forwardbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:51.290184021 CEST	1.1.1.1	192.168.2.4	0x954c	Name error (3)	degreecompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.071948051 CEST	1.1.1.1	192.168.2.4	0xb115	Name error (3)	answerfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.103987932 CEST	1.1.1.1	192.168.2.4	0x604a	Name error (3)	glassfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.119075060 CEST	1.1.1.1	192.168.2.4	0xb81a	Name error (3)	answercover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.130049944 CEST	1.1.1.1	192.168.2.4	0xb57	Name error (3)	glasscover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.141549110 CEST	1.1.1.1	192.168.2.4	0xb505	Name error (3)	answerbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.154079914 CEST	1.1.1.1	192.168.2.4	0x8783	Name error (3)	glassbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.167140007 CEST	1.1.1.1	192.168.2.4	0x6d55	Name error (3)	answercompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.646266937 CEST	1.1.1.1	192.168.2.4	0xcb8e	Name error (3)	difficultfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.679728031 CEST	1.1.1.1	192.168.2.4	0x2708	Name error (3)	heardfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.852741957 CEST	1.1.1.1	192.168.2.4	0xd2f5	Name error (3)	difficultcover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.868295908 CEST	1.1.1.1	192.168.2.4	0x6b1a	Name error (3)	heardcover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.879282951 CEST	1.1.1.1	192.168.2.4	0x8b9b	Name error (3)	difficultbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.890888929 CEST	1.1.1.1	192.168.2.4	0x1e2c	Name error (3)	heardbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.904325008 CEST	1.1.1.1	192.168.2.4	0x7	Name error (3)	difficultcompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:52.918318987 CEST	1.1.1.1	192.168.2.4	0xf2b3	Name error (3)	heardcompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:53.079493999 CEST	1.1.1.1	192.168.2.4	0x67ce	Name error (3)	pleasantfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:53.119944096 CEST	1.1.1.1	192.168.2.4	0xa48a	Name error (3)	necessaryfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:53.634460926 CEST	1.1.1.1	192.168.2.4	0xfedf	Name error (3)	necessarycover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:53.807913065 CEST	1.1.1.1	192.168.2.4	0xe65	Name error (3)	pleasantbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:53.848771095 CEST	1.1.1.1	192.168.2.4	0x8355	Name error (3)	necessarybecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:53.863404989 CEST	1.1.1.1	192.168.2.4	0x7220	Name error (3)	pleasantcompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:53.874034882 CEST	1.1.1.1	192.168.2.4	0xc63f	Name error (3)	necessarycompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:53.886977911 CEST	1.1.1.1	192.168.2.4	0xebbe	Name error (3)	orderfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:53.920269966 CEST	1.1.1.1	192.168.2.4	0x9b74	Name error (3)	requirefurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:53.932507038 CEST	1.1.1.1	192.168.2.4	0x4019	Name error (3)	ordercover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:53.966643095 CEST	1.1.1.1	192.168.2.4	0xc3a5	Name error (3)	requirecover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:53.982570887 CEST	1.1.1.1	192.168.2.4	0x15a3	Name error (3)	orderbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:54.020387888 CEST	1.1.1.1	192.168.2.4	0x7d44	Name error (3)	requirebecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:54.546838999 CEST	1.1.1.1	192.168.2.4	0x2373	No error (0)	ordercompany.net		210.157.78.4	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:55.402309895 CEST	1.1.1.1	192.168.2.4	0xe612	Name error (3)	requirecompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:59.911128998 CEST	1.1.1.1	192.168.2.4	0x6b85	Name error (3)	necessaryenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:59.923584938 CEST	1.1.1.1	192.168.2.4	0x129f	Name error (3)	pleasantgovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:59.935820103 CEST	1.1.1.1	192.168.2.4	0xd84f	Name error (3)	necessarygovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:59.947812080 CEST	1.1.1.1	192.168.2.4	0xa8af	Name error (3)	ordernature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:59.958518028 CEST	1.1.1.1	192.168.2.4	0x7416	Name error (3)	requirenature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:28:59.992185116 CEST	1.1.1.1	192.168.2.4	0xa6f4	Name error (3)	orderneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.003770113 CEST	1.1.1.1	192.168.2.4	0x99c2	Name error (3)	requireneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.014816046 CEST	1.1.1.1	192.168.2.4	0xb13e	Name error (3)	orderenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.026364088 CEST	1.1.1.1	192.168.2.4	0x84b7	Name error (3)	requireenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.037784100 CEST	1.1.1.1	192.168.2.4	0xf01a	Name error (3)	ordergovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.076275110 CEST	1.1.1.1	192.168.2.4	0xd969	Name error (3)	requiregovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.089154005 CEST	1.1.1.1	192.168.2.4	0xef7a	Name error (3)	leadernature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.125044107 CEST	1.1.1.1	192.168.2.4	0x5b26	Name error (3)	heavennature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.164529085 CEST	1.1.1.1	192.168.2.4	0xfe91	Name error (3)	leaderneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.176084042 CEST	1.1.1.1	192.168.2.4	0xd4ed	Name error (3)	heavenneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.208859921 CEST	1.1.1.1	192.168.2.4	0x6fba	Name error (3)	leaderenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.220822096 CEST	1.1.1.1	192.168.2.4	0xacca	Name error (3)	heavenenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.255624056 CEST	1.1.1.1	192.168.2.4	0x9d78	Name error (3)	leadergovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.267288923 CEST	1.1.1.1	192.168.2.4	0x61e8	Name error (3)	heavengovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.299108028 CEST	1.1.1.1	192.168.2.4	0x1d40	Name error (3)	heavynature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.331990004 CEST	1.1.1.1	192.168.2.4	0x593e	Name error (3)	gentlenature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.377178907 CEST	1.1.1.1	192.168.2.4	0x1c06	Name error (3)	heavyneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.389302015 CEST	1.1.1.1	192.168.2.4	0x6edd	Name error (3)	gentleneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.424264908 CEST	1.1.1.1	192.168.2.4	0xce54	Name error (3)	heavyenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.437735081 CEST	1.1.1.1	192.168.2.4	0x38b2	Name error (3)	gentleenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.599642992 CEST	1.1.1.1	192.168.2.4	0x1762	Name error (3)	heavygovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.615637064 CEST	1.1.1.1	192.168.2.4	0x3644	Name error (3)	gentlegovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.650736094 CEST	1.1.1.1	192.168.2.4	0x48f3	Name error (3)	variousnature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.663043022 CEST	1.1.1.1	192.168.2.4	0x68b9	Name error (3)	returnnature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:00.676719904 CEST	1.1.1.1	192.168.2.4	0x7603	Name error (3)	variousneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:01.417331934 CEST	1.1.1.1	192.168.2.4	0x946	Name error (3)	variousenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:01.431292057 CEST	1.1.1.1	192.168.2.4	0xb499	Name error (3)	returnenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:01.441975117 CEST	1.1.1.1	192.168.2.4	0x7e04	Name error (3)	variousgovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:01.481990099 CEST	1.1.1.1	192.168.2.4	0x5bbc	Name error (3)	returngovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:01.494277954 CEST	1.1.1.1	192.168.2.4	0x6ccc	Name error (3)	degreefurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:01.531297922 CEST	1.1.1.1	192.168.2.4	0xebee	Name error (3)	forwardfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:01.547818899 CEST	1.1.1.1	192.168.2.4	0x41e9	Name error (3)	degreecover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:01.584518909 CEST	1.1.1.1	192.168.2.4	0x8d31	Name error (3)	forwardcover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:01.625305891 CEST	1.1.1.1	192.168.2.4	0xdda4	Name error (3)	degreebecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:01.638153076 CEST	1.1.1.1	192.168.2.4	0x25ea	Name error (3)	forwardbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:01.651551962 CEST	1.1.1.1	192.168.2.4	0x531d	Name error (3)	degreecompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:02.402667999 CEST	1.1.1.1	192.168.2.4	0x9100	Name error (3)	answerfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:02.417562962 CEST	1.1.1.1	192.168.2.4	0xf3d2	Name error (3)	glassfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:02.429759026 CEST	1.1.1.1	192.168.2.4	0x164a	Name error (3)	answercover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:02.441572905 CEST	1.1.1.1	192.168.2.4	0x2343	Name error (3)	glasscover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:02.453607082 CEST	1.1.1.1	192.168.2.4	0x278f	Name error (3)	answerbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:02.493717909 CEST	1.1.1.1	192.168.2.4	0x88bb	Name error (3)	glassbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:02.529685974 CEST	1.1.1.1	192.168.2.4	0xbdd2	Name error (3)	answercompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:03.015990973 CEST	1.1.1.1	192.168.2.4	0xda8c	Name error (3)	difficultfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:03.048245907 CEST	1.1.1.1	192.168.2.4	0x9925	Name error (3)	heardfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:03.083533049 CEST	1.1.1.1	192.168.2.4	0xa4b9	Name error (3)	difficultcover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:03.416898012 CEST	1.1.1.1	192.168.2.4	0xfb4a	Name error (3)	heardcover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:03.434756994 CEST	1.1.1.1	192.168.2.4	0x99	Name error (3)	difficultbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:03.468475103 CEST	1.1.1.1	192.168.2.4	0x29c6	Name error (3)	heardbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:03.499856949 CEST	1.1.1.1	192.168.2.4	0xceea	Name error (3)	difficultcompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:03.510364056 CEST	1.1.1.1	192.168.2.4	0x1df1	Name error (3)	heardcompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:03.522382975 CEST	1.1.1.1	192.168.2.4	0x8949	Name error (3)	pleasantfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:03.533900976 CEST	1.1.1.1	192.168.2.4	0x1d9d	Name error (3)	necessaryfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:04.056524992 CEST	1.1.1.1	192.168.2.4	0xdaab	Name error (3)	necessarycover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:04.077851057 CEST	1.1.1.1	192.168.2.4	0x392c	Name error (3)	pleasantbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:04.106250048 CEST	1.1.1.1	192.168.2.4	0xc621	Name error (3)	necessarybecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:04.135023117 CEST	1.1.1.1	192.168.2.4	0x6197	Name error (3)	pleasantcompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:04.157249928 CEST	1.1.1.1	192.168.2.4	0x3ae0	Name error (3)	necessarycompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:04.440036058 CEST	1.1.1.1	192.168.2.4	0x656c	Name error (3)	orderfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:04.456969023 CEST	1.1.1.1	192.168.2.4	0x8b2a	Name error (3)	requirefurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:04.468709946 CEST	1.1.1.1	192.168.2.4	0x49fd	Name error (3)	ordercover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:04.505619049 CEST	1.1.1.1	192.168.2.4	0xd4d7	Name error (3)	requirecover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:04.518942118 CEST	1.1.1.1	192.168.2.4	0xcca0	Name error (3)	orderbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:04.531543970 CEST	1.1.1.1	192.168.2.4	0x16e8	Name error (3)	requirebecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:05.750504971 CEST	1.1.1.1	192.168.2.4	0xa57f	Name error (3)	requirecompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:05.762093067 CEST	1.1.1.1	192.168.2.4	0x23be	Name error (3)	leaderfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:05.773885012 CEST	1.1.1.1	192.168.2.4	0xbffb	Name error (3)	heavenfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:05.785048962 CEST	1.1.1.1	192.168.2.4	0x62a1	Name error (3)	leadercover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:05.817622900 CEST	1.1.1.1	192.168.2.4	0xc181	Name error (3)	heavencover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:05.828694105 CEST	1.1.1.1	192.168.2.4	0xccc7	Name error (3)	leaderbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:05.862397909 CEST	1.1.1.1	192.168.2.4	0x46b8	Name error (3)	heavenbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:05.996939898 CEST	1.1.1.1	192.168.2.4	0xd77c	No error (0)	leadercompany.net		185.111.247.38	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:06.848793983 CEST	1.1.1.1	192.168.2.4	0x757	Name error (3)	heavencompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:06.886691093 CEST	1.1.1.1	192.168.2.4	0xf855	Name error (3)	heavyfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:06.898998022 CEST	1.1.1.1	192.168.2.4	0x21a7	Name error (3)	gentlefurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.411957979 CEST	1.1.1.1	192.168.2.4	0x2853	Name error (3)	leadernature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.423286915 CEST	1.1.1.1	192.168.2.4	0x59de	Name error (3)	heavennature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.435648918 CEST	1.1.1.1	192.168.2.4	0x76e5	Name error (3)	leaderneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.464720964 CEST	1.1.1.1	192.168.2.4	0x1796	Name error (3)	heavenneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.479769945 CEST	1.1.1.1	192.168.2.4	0x2b0e	Name error (3)	leaderenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.515147924 CEST	1.1.1.1	192.168.2.4	0x9126	Name error (3)	heavenenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.550947905 CEST	1.1.1.1	192.168.2.4	0x40dc	Name error (3)	leadergovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.563805103 CEST	1.1.1.1	192.168.2.4	0x61eb	Name error (3)	heavengovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.576072931 CEST	1.1.1.1	192.168.2.4	0x17c7	Name error (3)	heavynature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.588906050 CEST	1.1.1.1	192.168.2.4	0x9de9	Name error (3)	gentlenature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.599961996 CEST	1.1.1.1	192.168.2.4	0xd346	Name error (3)	heavyneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.612886906 CEST	1.1.1.1	192.168.2.4	0xf0e8	Name error (3)	gentleneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.649171114 CEST	1.1.1.1	192.168.2.4	0x5cca	Name error (3)	heavyenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.662306070 CEST	1.1.1.1	192.168.2.4	0xa83b	Name error (3)	gentleenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.836005926 CEST	1.1.1.1	192.168.2.4	0x502b	Name error (3)	heavygovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.871547937 CEST	1.1.1.1	192.168.2.4	0x32be	Name error (3)	gentlegovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:11.904134035 CEST	1.1.1.1	192.168.2.4	0x7996	Name error (3)	variousnature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:12.065608025 CEST	1.1.1.1	192.168.2.4	0x1cf0	Name error (3)	returnnature.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:12.079703093 CEST	1.1.1.1	192.168.2.4	0x5a02	Name error (3)	variousneedle.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:13.056622982 CEST	1.1.1.1	192.168.2.4	0xd1e4	Name error (3)	variousenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:13.067346096 CEST	1.1.1.1	192.168.2.4	0xbb51	Name error (3)	returnenough.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:13.104300022 CEST	1.1.1.1	192.168.2.4	0x3480	Name error (3)	variousgovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:13.116532087 CEST	1.1.1.1	192.168.2.4	0x9733	Name error (3)	returngovern.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:13.150419950 CEST	1.1.1.1	192.168.2.4	0x7b6f	Name error (3)	degreefurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:13.162533998 CEST	1.1.1.1	192.168.2.4	0x9b9d	Name error (3)	forwardfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:13.173902035 CEST	1.1.1.1	192.168.2.4	0x411	Name error (3)	degreecover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:13.193353891 CEST	1.1.1.1	192.168.2.4	0x390f	Name error (3)	forwardcover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:13.206099987 CEST	1.1.1.1	192.168.2.4	0x80e2	Name error (3)	degreebecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:13.216545105 CEST	1.1.1.1	192.168.2.4	0x8022	Name error (3)	forwardbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:13.229352951 CEST	1.1.1.1	192.168.2.4	0x8b2c	Name error (3)	degreecompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.002518892 CEST	1.1.1.1	192.168.2.4	0xb8a3	Name error (3)	answerfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.039557934 CEST	1.1.1.1	192.168.2.4	0xaf4b	Name error (3)	glassfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.050653934 CEST	1.1.1.1	192.168.2.4	0x7d15	Name error (3)	answercover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.061521053 CEST	1.1.1.1	192.168.2.4	0xda76	Name error (3)	glasscover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.073775053 CEST	1.1.1.1	192.168.2.4	0xe338	Name error (3)	answerbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.108967066 CEST	1.1.1.1	192.168.2.4	0x7c55	Name error (3)	glassbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.122062922 CEST	1.1.1.1	192.168.2.4	0xc60a	Name error (3)	answercompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.624492884 CEST	1.1.1.1	192.168.2.4	0x63b1	Name error (3)	difficultfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.636476994 CEST	1.1.1.1	192.168.2.4	0x8c71	Name error (3)	heardfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.668234110 CEST	1.1.1.1	192.168.2.4	0x728e	Name error (3)	difficultcover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.707294941 CEST	1.1.1.1	192.168.2.4	0x43cc	Name error (3)	heardcover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.884077072 CEST	1.1.1.1	192.168.2.4	0xe0c	Name error (3)	difficultbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.908761024 CEST	1.1.1.1	192.168.2.4	0x1ff6	Name error (3)	heardbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.943896055 CEST	1.1.1.1	192.168.2.4	0xbc9	Name error (3)	difficultcompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.955274105 CEST	1.1.1.1	192.168.2.4	0x7505	Name error (3)	heardcompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:14.965862036 CEST	1.1.1.1	192.168.2.4	0xf61e	Name error (3)	pleasantfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:15.002609015 CEST	1.1.1.1	192.168.2.4	0x722b	Name error (3)	necessaryfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:15.508517981 CEST	1.1.1.1	192.168.2.4	0x911b	Name error (3)	necessarycover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:15.543019056 CEST	1.1.1.1	192.168.2.4	0xc3ff	Name error (3)	pleasantbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:15.719302893 CEST	1.1.1.1	192.168.2.4	0xac29	Name error (3)	necessarybecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:15.734956980 CEST	1.1.1.1	192.168.2.4	0x554d	Name error (3)	pleasantcompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:15.770735979 CEST	1.1.1.1	192.168.2.4	0x681f	Name error (3)	necessarycompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:15.782696009 CEST	1.1.1.1	192.168.2.4	0x7895	Name error (3)	orderfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:15.944715023 CEST	1.1.1.1	192.168.2.4	0x1b77	Name error (3)	requirefurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:15.960464954 CEST	1.1.1.1	192.168.2.4	0x1f19	Name error (3)	ordercover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:16.118673086 CEST	1.1.1.1	192.168.2.4	0x338f	Name error (3)	requirecover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:16.135003090 CEST	1.1.1.1	192.168.2.4	0x7e38	Name error (3)	orderbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:16.146373034 CEST	1.1.1.1	192.168.2.4	0xe98	Name error (3)	requirebecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:16.983405113 CEST	1.1.1.1	192.168.2.4	0x3a17	Name error (3)	requirecompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:17.020791054 CEST	1.1.1.1	192.168.2.4	0xa3ab	Name error (3)	leaderfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:17.057077885 CEST	1.1.1.1	192.168.2.4	0x3347	Name error (3)	heavenfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:17.067508936 CEST	1.1.1.1	192.168.2.4	0x26fc	Name error (3)	leadercover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:17.077383995 CEST	1.1.1.1	192.168.2.4	0x7b16	Name error (3)	heavencover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:17.107487917 CEST	1.1.1.1	192.168.2.4	0xbaea	Name error (3)	leaderbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:17.149900913 CEST	1.1.1.1	192.168.2.4	0xadb3	Name error (3)	heavenbecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:17.983875990 CEST	1.1.1.1	192.168.2.4	0xd12a	Name error (3)	heavencompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:18.446687937 CEST	1.1.1.1	192.168.2.4	0x4b42	Name error (3)	heavyfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:18.487235069 CEST	1.1.1.1	192.168.2.4	0x8c1b	Name error (3)	gentlefurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:19.791028023 CEST	1.1.1.1	192.168.2.4	0x7d02	No error (0)	heavycover.net		162.43.112.11	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:19.791209936 CEST	1.1.1.1	192.168.2.4	0x7d02	No error (0)	heavycover.net		162.43.112.11	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:20.657280922 CEST	1.1.1.1	192.168.2.4	0x4841	Name error (3)	gentlecover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:20.671979904 CEST	1.1.1.1	192.168.2.4	0xace9	Name error (3)	heavybecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:20.683190107 CEST	1.1.1.1	192.168.2.4	0x1ae	Name error (3)	gentlebecome.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:20.720767021 CEST	1.1.1.1	192.168.2.4	0x2ed8	Name error (3)	heavycompany.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:20.766282082 CEST	1.1.1.1	192.168.2.4	0xae89	No error (0)	gentlecompany.net		103.169.142.0	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:21.289216995 CEST	1.1.1.1	192.168.2.4	0xa934	Name error (3)	variousfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:21.329318047 CEST	1.1.1.1	192.168.2.4	0xbcc9	Name error (3)	returnfurther.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:21.365353107 CEST	1.1.1.1	192.168.2.4	0x95f7	Name error (3)	variouscover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:21.380625963 CEST	1.1.1.1	192.168.2.4	0xb1aa	Name error (3)	returncover.net	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 16:29:21.397382021 CEST	1.1.1.1	192.168.2.4	0x69b0	Name error (3)	variousbecome.net	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

returnneedle.net

forwardcompany.net

glasscompany.net

pleasantcover.net

ordercompany.net

leadercompany.net

heavycover.net

gentlecompany.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	54.244.188.177	80	5772	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:27:21.342403889 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: returnneedle.net
Oct 9, 2024 16:27:22.072129965 CEST	381	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 09 Oct 2024 14:27:21 GMT Content-Type: text/html Connection: close Set-Cookie: btst=d78b988f142ee5ab6135ce5b8974f1fd\|8.46.123.33\|1728484041\|1728484041\|0\|1\|0; path=/; domain=.returnneedle.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	50245	34.218.204.173	80	5772	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:27:23.323750019 CEST	85	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: forwardcompany.net
Oct 9, 2024 16:27:24.080430031 CEST	383	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 09 Oct 2024 14:27:23 GMT Content-Type: text/html Connection: close Set-Cookie: btst=8d9da7e0de57ab8f873a815d57227884\|8.46.123.33\|1728484043\|1728484043\|0\|1\|0; path=/; domain=.forwardcompany.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	50246	52.71.57.184	80	5772	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:27:24.464997053 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: glasscompany.net
Oct 9, 2024 16:27:24.951749086 CEST	174	IN	HTTP/1.1 302 Found content-length: 0 date: Wed, 09 Oct 2024 14:27:23 GMT location: https://www.hugedomains.com/domain_profile.cfm?d=glasscompany.net connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	50247	199.59.243.227	80	5772	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:27:25.591036081 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: pleasantcover.net
Oct 9, 2024 16:27:26.078423023 CEST	1236	IN	HTTP/1.1 200 OK date: Wed, 09 Oct 2024 14:27:25 GMT content-type: text/html; charset=utf-8 content-length: 1062 x-request-id: 0bb013c6-be87-4a17-9bdc-7f768ecd0878 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_xEp6L8+31RoRHrUkSlSqRyKFAGFxxdZZmxezQ1LEDS3SNX8/Eq4hmikUS494oRTcvsdLCiEs445+uASuG8K+aA== set-cookie: parking_session=0bb013c6-be87-4a17-9bdc-7f768ecd0878; expires=Wed, 09 Oct 2024 14:42:26 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 78 45 70 36 4c 38 2b 33 31 52 6f 52 48 72 55 6b 53 6c 53 71 52 79 4b 46 41 47 46 78 78 64 5a 5a 6d 78 65 7a 51 31 4c 45 44 53 33 53 4e 58 38 2f 45 71 34 68 6d 69 6b 55 53 34 39 34 6f 52 54 63 76 73 64 4c 43 69 45 73 34 34 35 2b 75 41 53 75 47 38 4b 2b 61 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_xEp6L8+31RoRHrUkSlSqRyKFAGFxxdZZmxezQ1LEDS3SNX8/Eq4hmikUS494oRTcvsdLCiEs445+uASuG8K+aA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 9, 2024 16:27:26.078448057 CEST	515	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMGJiMDEzYzYtYmU4Ny00YTE3LTliZGMtN2Y3NjhlY2QwODc4IiwicGFnZV90aW1lIjoxNzI4NDg0MD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	50397	54.244.188.177	80	600	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:28:39.068682909 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: returnneedle.net
Oct 9, 2024 16:28:39.802243948 CEST	381	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 09 Oct 2024 14:28:39 GMT Content-Type: text/html Connection: close Set-Cookie: btst=dd2e1ec173bf147e97ccceaecffc8eef\|8.46.123.33\|1728484119\|1728484119\|0\|1\|0; path=/; domain=.returnneedle.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	50404	34.218.204.173	80	600	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:28:40.202727079 CEST	85	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: forwardcompany.net
Oct 9, 2024 16:28:41.879479885 CEST	383	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 09 Oct 2024 14:28:40 GMT Content-Type: text/html Connection: close Set-Cookie: btst=af20e31b64793da01024887626ba13ca\|8.46.123.33\|1728484120\|1728484120\|0\|1\|0; path=/; domain=.forwardcompany.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
Oct 9, 2024 16:28:41.879776001 CEST	383	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 09 Oct 2024 14:28:40 GMT Content-Type: text/html Connection: close Set-Cookie: btst=af20e31b64793da01024887626ba13ca\|8.46.123.33\|1728484120\|1728484120\|0\|1\|0; path=/; domain=.forwardcompany.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
Oct 9, 2024 16:28:41.880465031 CEST	383	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 09 Oct 2024 14:28:40 GMT Content-Type: text/html Connection: close Set-Cookie: btst=af20e31b64793da01024887626ba13ca\|8.46.123.33\|1728484120\|1728484120\|0\|1\|0; path=/; domain=.forwardcompany.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	50414	54.209.32.212	80	600	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:28:42.253575087 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: glasscompany.net
Oct 9, 2024 16:28:42.731489897 CEST	174	IN	HTTP/1.1 302 Found content-length: 0 date: Wed, 09 Oct 2024 14:28:42 GMT location: https://www.hugedomains.com/domain_profile.cfm?d=glasscompany.net connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	50418	199.59.243.227	80	600	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:28:42.938688040 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: pleasantcover.net
Oct 9, 2024 16:28:43.444996119 CEST	1236	IN	HTTP/1.1 200 OK date: Wed, 09 Oct 2024 14:28:42 GMT content-type: text/html; charset=utf-8 content-length: 1062 x-request-id: 886074a5-5f55-4ec5-961e-d595f2f538c7 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_xEp6L8+31RoRHrUkSlSqRyKFAGFxxdZZmxezQ1LEDS3SNX8/Eq4hmikUS494oRTcvsdLCiEs445+uASuG8K+aA== set-cookie: parking_session=886074a5-5f55-4ec5-961e-d595f2f538c7; expires=Wed, 09 Oct 2024 14:43:43 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 78 45 70 36 4c 38 2b 33 31 52 6f 52 48 72 55 6b 53 6c 53 71 52 79 4b 46 41 47 46 78 78 64 5a 5a 6d 78 65 7a 51 31 4c 45 44 53 33 53 4e 58 38 2f 45 71 34 68 6d 69 6b 55 53 34 39 34 6f 52 54 63 76 73 64 4c 43 69 45 73 34 34 35 2b 75 41 53 75 47 38 4b 2b 61 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_xEp6L8+31RoRHrUkSlSqRyKFAGFxxdZZmxezQ1LEDS3SNX8/Eq4hmikUS494oRTcvsdLCiEs445+uASuG8K+aA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 9, 2024 16:28:43.445487976 CEST	224	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiODg2MDc0YTUtNWY1NS00ZWM1LTk2MWUtZDU5NWYyZjUzOGM3IiwicGFnZV9
Oct 9, 2024 16:28:43.445521116 CEST	291	IN	Data Raw: 30 61 57 31 6c 49 6a 6f 78 4e 7a 49 34 4e 44 67 30 4d 54 49 7a 4c 43 4a 77 59 57 64 6c 58 33 56 79 62 43 49 36 49 6d 68 30 64 48 41 36 4c 79 39 77 62 47 56 68 63 32 46 75 64 47 4e 76 64 6d 56 79 4c 6d 35 6c 64 43 39 70 62 6d 52 6c 65 43 35 77 61 Data Ascii: 0aW1lIjoxNzI4NDg0MTIzLCJwYWdlX3VybCI6Imh0dHA6Ly9wbGVhc2FudGNvdmVyLm5ldC9pbmRleC5waHAiLCJwYWdlX21ldGhvZCI6IkdFVCIsInBhZ2VfcmVxdWVzdCI6e30sInBhZ2VfaGVhZGVycyI6e30sImhvc3QiOiJwbGVhc2FudGNvdmVyLm5ldCIsImlwIjoiOC40Ni4xMjMuMzMifQo=";</script><scrip

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	50458	54.244.188.177	80	600	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:28:50.186424017 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: returnneedle.net
Oct 9, 2024 16:28:50.925986052 CEST	381	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 09 Oct 2024 14:28:50 GMT Content-Type: text/html Connection: close Set-Cookie: btst=c917e3e4879d865df4b2a86c80e51da4\|8.46.123.33\|1728484130\|1728484130\|0\|1\|0; path=/; domain=.returnneedle.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	50467	34.218.204.173	80	600	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:28:51.297095060 CEST	85	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: forwardcompany.net
Oct 9, 2024 16:28:52.056229115 CEST	383	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 09 Oct 2024 14:28:51 GMT Content-Type: text/html Connection: close Set-Cookie: btst=a6991c9bfe95f84e3e395065c6021daf\|8.46.123.33\|1728484131\|1728484131\|0\|1\|0; path=/; domain=.forwardcompany.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	50473	54.209.32.212	80	600	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:28:52.172791004 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: glasscompany.net
Oct 9, 2024 16:28:52.632476091 CEST	174	IN	HTTP/1.1 302 Found content-length: 0 date: Wed, 09 Oct 2024 14:28:52 GMT location: https://www.hugedomains.com/domain_profile.cfm?d=glasscompany.net connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	50480	199.59.243.227	80	600	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:28:53.127873898 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: pleasantcover.net
Oct 9, 2024 16:28:53.593441963 CEST	1236	IN	HTTP/1.1 200 OK date: Wed, 09 Oct 2024 14:28:52 GMT content-type: text/html; charset=utf-8 content-length: 1062 x-request-id: aadb4684-5a97-4937-998a-8e2fec57fc5e cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_xEp6L8+31RoRHrUkSlSqRyKFAGFxxdZZmxezQ1LEDS3SNX8/Eq4hmikUS494oRTcvsdLCiEs445+uASuG8K+aA== set-cookie: parking_session=aadb4684-5a97-4937-998a-8e2fec57fc5e; expires=Wed, 09 Oct 2024 14:43:53 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 78 45 70 36 4c 38 2b 33 31 52 6f 52 48 72 55 6b 53 6c 53 71 52 79 4b 46 41 47 46 78 78 64 5a 5a 6d 78 65 7a 51 31 4c 45 44 53 33 53 4e 58 38 2f 45 71 34 68 6d 69 6b 55 53 34 39 34 6f 52 54 63 76 73 64 4c 43 69 45 73 34 34 35 2b 75 41 53 75 47 38 4b 2b 61 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_xEp6L8+31RoRHrUkSlSqRyKFAGFxxdZZmxezQ1LEDS3SNX8/Eq4hmikUS494oRTcvsdLCiEs445+uASuG8K+aA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 9, 2024 16:28:53.593458891 CEST	515	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYWFkYjQ2ODQtNWE5Ny00OTM3LTk5OGEtOGUyZmVjNTdmYzVlIiwicGFnZV90aW1lIjoxNzI4NDg0MT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	50487	210.157.78.4	80	600	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:28:54.560416937 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: ordercompany.net
Oct 9, 2024 16:28:55.363424063 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 09 Oct 2024 14:28:55 GMT Content-Type: text/html Content-Length: 2814 Connection: close Vary: Accept-Encoding Last-Modified: Thu, 22 Apr 2021 10:24:00 GMT ETag: "afe-5c08d13eb1b03" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 45 55 43 2d 4a 50 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 58 53 45 52 56 45 52 20 49 6e 63 2e 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 4e 44 45 58 2c 46 4f 4c 4c 4f 57 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2a 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="ja"><head><meta charset="EUC-JP" /><title>404 File Not Found</title><meta name="copyright" content="Copyright XSERVER Inc."><meta name="robots" content="INDEX,FOLLOW" /><meta name="viewport" content="width=device-width,initial-scale=1.0,minimum-scale=1.0"><style type="text/css">* { margin: 0; padding: 0;}img { border: 0;}ul { padding-left: 2em;}html { overflow-y: scroll; background: #3b79b7;}body { font-family: "", Meiryo, " ", "MS PGothic", " Pro W3", "Hiragino Kaku Gothic Pro", sans-serif; margin: 0; line-height: 1.4; font-size: 75%; text-align: center; color: white;}h1 { font-size: 24px; font-weight: bold;}h1 { font-weight: bold; line-height: 1; padding-bottom: 20px; font-family: Helvetica, sans-serif;}h2 { text-align: center; font-weight: bold; font-size: 27px;}p { text-align: center; font-size: 14px;
Oct 9, 2024 16:28:55.363487005 CEST	1236	IN	Data Raw: 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 77 68 69 74 65 3b 0a 7d 0a 2e 65 78 70 6c 61 69 6e 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 Data Ascii: margin: 0; padding: 0; color: white;}.explain { border-top: 1px solid #fff; border-bottom: 1px solid #fff; line-height: 1.5; margin: 30px auto; padding: 17px;}#cause { text-align: left;}#cause li {
Oct 9, 2024 16:28:55.363524914 CEST	582	IN	Data Raw: 64 69 76 20 69 64 3d 22 62 61 73 65 22 3e 0a 20 20 20 20 3c 68 31 3e 3c 73 70 61 6e 3e 34 30 34 3c 2f 73 70 61 6e 3e 3c 62 72 20 2f 3e 0a 20 20 20 20 20 20 20 20 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 68 32 3e Data Ascii: div id="base"> <h1><span>404</span><br /> File Not Found</h1> <h2></h2> <p class="explain"></p> <h3>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	50523	54.244.188.177	80	600	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:29:00.683763027 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: returnneedle.net
Oct 9, 2024 16:29:01.401902914 CEST	381	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 09 Oct 2024 14:29:01 GMT Content-Type: text/html Connection: close Set-Cookie: btst=9c3b03fc0abfc25a52607afbdd35a5b1\|8.46.123.33\|1728484141\|1728484141\|0\|1\|0; path=/; domain=.returnneedle.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	50529	34.218.204.173	80	600	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:29:01.663429022 CEST	85	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: forwardcompany.net
Oct 9, 2024 16:29:02.385793924 CEST	383	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 09 Oct 2024 14:29:02 GMT Content-Type: text/html Connection: close Set-Cookie: btst=46344f8a4c8177f0b3c8024c0c47808f\|8.46.123.33\|1728484142\|1728484142\|0\|1\|0; path=/; domain=.forwardcompany.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	50531	54.209.32.212	80	600	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:29:02.539334059 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: glasscompany.net
Oct 9, 2024 16:29:03.000838041 CEST	174	IN	HTTP/1.1 302 Found content-length: 0 date: Wed, 09 Oct 2024 14:29:02 GMT location: https://www.hugedomains.com/domain_profile.cfm?d=glasscompany.net connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	50532	199.59.243.227	80	600	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:29:03.540185928 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: pleasantcover.net
Oct 9, 2024 16:29:04.018954039 CEST	1236	IN	HTTP/1.1 200 OK date: Wed, 09 Oct 2024 14:29:03 GMT content-type: text/html; charset=utf-8 content-length: 1062 x-request-id: 896e84bd-d053-4ddb-aa45-22cdb253381a cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_xEp6L8+31RoRHrUkSlSqRyKFAGFxxdZZmxezQ1LEDS3SNX8/Eq4hmikUS494oRTcvsdLCiEs445+uASuG8K+aA== set-cookie: parking_session=896e84bd-d053-4ddb-aa45-22cdb253381a; expires=Wed, 09 Oct 2024 14:44:03 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 78 45 70 36 4c 38 2b 33 31 52 6f 52 48 72 55 6b 53 6c 53 71 52 79 4b 46 41 47 46 78 78 64 5a 5a 6d 78 65 7a 51 31 4c 45 44 53 33 53 4e 58 38 2f 45 71 34 68 6d 69 6b 55 53 34 39 34 6f 52 54 63 76 73 64 4c 43 69 45 73 34 34 35 2b 75 41 53 75 47 38 4b 2b 61 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_xEp6L8+31RoRHrUkSlSqRyKFAGFxxdZZmxezQ1LEDS3SNX8/Eq4hmikUS494oRTcvsdLCiEs445+uASuG8K+aA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 9, 2024 16:29:04.019299030 CEST	515	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiODk2ZTg0YmQtZDA1My00ZGRiLWFhNDUtMjJjZGIyNTMzODFhIiwicGFnZV90aW1lIjoxNzI4NDg0MT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	50533	210.157.78.4	80	600	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:29:04.537552118 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: ordercompany.net
Oct 9, 2024 16:29:05.731906891 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 09 Oct 2024 14:29:05 GMT Content-Type: text/html Content-Length: 2814 Connection: close Vary: Accept-Encoding Last-Modified: Thu, 22 Apr 2021 10:24:00 GMT ETag: "afe-5c08d13eb1b03" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 45 55 43 2d 4a 50 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 58 53 45 52 56 45 52 20 49 6e 63 2e 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 4e 44 45 58 2c 46 4f 4c 4c 4f 57 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2a 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="ja"><head><meta charset="EUC-JP" /><title>404 File Not Found</title><meta name="copyright" content="Copyright XSERVER Inc."><meta name="robots" content="INDEX,FOLLOW" /><meta name="viewport" content="width=device-width,initial-scale=1.0,minimum-scale=1.0"><style type="text/css">* { margin: 0; padding: 0;}img { border: 0;}ul { padding-left: 2em;}html { overflow-y: scroll; background: #3b79b7;}body { font-family: "", Meiryo, " ", "MS PGothic", " Pro W3", "Hiragino Kaku Gothic Pro", sans-serif; margin: 0; line-height: 1.4; font-size: 75%; text-align: center; color: white;}h1 { font-size: 24px; font-weight: bold;}h1 { font-weight: bold; line-height: 1; padding-bottom: 20px; font-family: Helvetica, sans-serif;}h2 { text-align: center; font-weight: bold; font-size: 27px;}p { text-align: center; font-size: 14px;
Oct 9, 2024 16:29:05.731923103 CEST	224	IN	Data Raw: 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 77 68 69 74 65 3b 0a 7d 0a 2e 65 78 70 6c 61 69 6e 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 Data Ascii: margin: 0; padding: 0; color: white;}.explain { border-top: 1px solid #fff; border-bottom: 1px solid #fff; line-height: 1.5; margin: 30px auto; padding: 17px;}#cause { text-align: left;
Oct 9, 2024 16:29:05.731930017 CEST	1236	IN	Data Raw: 0a 7d 0a 23 63 61 75 73 65 20 6c 69 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 36 36 36 3b 0a 7d 0a 68 33 20 7b 0a 20 20 20 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 31 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 Data Ascii: }#cause li { color: #666;}h3 { letter-spacing: 1px; font-weight: bold; padding: 0;}#white_box { margin: 15px auto 0; background-color: white;}/* ==================== ======================= *
Oct 9, 2024 16:29:05.731947899 CEST	358	IN	Data Raw: a3 3c 2f 70 3e 0a 20 20 20 20 3c 68 33 3e b0 ca b2 bc a4 ce a4 e8 a4 a6 a4 ca b8 b6 b0 f8 a4 ac b9 cd a4 a8 a4 e9 a4 ec a4 de a4 b9 a1 a3 3c 2f 68 33 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 77 68 69 74 65 5f 62 6f 78 22 3e 0a 20 20 20 20 20 Data Ascii: </p> <h3></h3> <div id="white_box"> <div id="cause"> <ul> <li></li> <li>UR
Oct 9, 2024 16:29:05.733041048 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 09 Oct 2024 14:29:05 GMT Content-Type: text/html Content-Length: 2814 Connection: close Vary: Accept-Encoding Last-Modified: Thu, 22 Apr 2021 10:24:00 GMT ETag: "afe-5c08d13eb1b03" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 45 55 43 2d 4a 50 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 58 53 45 52 56 45 52 20 49 6e 63 2e 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 4e 44 45 58 2c 46 4f 4c 4c 4f 57 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2a 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="ja"><head><meta charset="EUC-JP" /><title>404 File Not Found</title><meta name="copyright" content="Copyright XSERVER Inc."><meta name="robots" content="INDEX,FOLLOW" /><meta name="viewport" content="width=device-width,initial-scale=1.0,minimum-scale=1.0"><style type="text/css">* { margin: 0; padding: 0;}img { border: 0;}ul { padding-left: 2em;}html { overflow-y: scroll; background: #3b79b7;}body { font-family: "", Meiryo, " ", "MS PGothic", " Pro W3", "Hiragino Kaku Gothic Pro", sans-serif; margin: 0; line-height: 1.4; font-size: 75%; text-align: center; color: white;}h1 { font-size: 24px; font-weight: bold;}h1 { font-weight: bold; line-height: 1; padding-bottom: 20px; font-family: Helvetica, sans-serif;}h2 { text-align: center; font-weight: bold; font-size: 27px;}p { text-align: center; font-size: 14px;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	50534	185.111.247.38	80	600	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:29:06.004967928 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: leadercompany.net
Oct 9, 2024 16:29:06.833544016 CEST	213	IN	HTTP/1.0 301 Moved Permanently Connection: close content-type: text/html; charset=UTF-8 x-redirect-by: WordPress location: https://leadercompany.net/ content-length: 0 date: Wed, 09 Oct 2024 14:29:05 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	50535	54.244.188.177	80	600	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:29:12.085675001 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: returnneedle.net
Oct 9, 2024 16:29:13.040664911 CEST	381	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 09 Oct 2024 14:29:12 GMT Content-Type: text/html Connection: close Set-Cookie: btst=4b8a28bf23da9cd64a7dd8661ad1cfbc\|8.46.123.33\|1728484152\|1728484152\|0\|1\|0; path=/; domain=.returnneedle.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	50536	34.218.204.173	80	600	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:29:13.235224962 CEST	85	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: forwardcompany.net
Oct 9, 2024 16:29:13.986573935 CEST	383	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 09 Oct 2024 14:29:13 GMT Content-Type: text/html Connection: close Set-Cookie: btst=e7f7d3d49b7a037bb412b8586ad653de\|8.46.123.33\|1728484153\|1728484153\|0\|1\|0; path=/; domain=.forwardcompany.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	50537	54.209.32.212	80	600	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:29:14.127835035 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: glasscompany.net
Oct 9, 2024 16:29:14.606399059 CEST	174	IN	HTTP/1.1 302 Found content-length: 0 date: Wed, 09 Oct 2024 14:29:14 GMT location: https://www.hugedomains.com/domain_profile.cfm?d=glasscompany.net connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	50538	199.59.243.227	80	600	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:29:15.009206057 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: pleasantcover.net
Oct 9, 2024 16:29:15.492477894 CEST	1236	IN	HTTP/1.1 200 OK date: Wed, 09 Oct 2024 14:29:15 GMT content-type: text/html; charset=utf-8 content-length: 1062 x-request-id: 1d7914de-d4ea-41ff-846d-4a14c3dc0ce4 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_xEp6L8+31RoRHrUkSlSqRyKFAGFxxdZZmxezQ1LEDS3SNX8/Eq4hmikUS494oRTcvsdLCiEs445+uASuG8K+aA== set-cookie: parking_session=1d7914de-d4ea-41ff-846d-4a14c3dc0ce4; expires=Wed, 09 Oct 2024 14:44:15 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 78 45 70 36 4c 38 2b 33 31 52 6f 52 48 72 55 6b 53 6c 53 71 52 79 4b 46 41 47 46 78 78 64 5a 5a 6d 78 65 7a 51 31 4c 45 44 53 33 53 4e 58 38 2f 45 71 34 68 6d 69 6b 55 53 34 39 34 6f 52 54 63 76 73 64 4c 43 69 45 73 34 34 35 2b 75 41 53 75 47 38 4b 2b 61 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_xEp6L8+31RoRHrUkSlSqRyKFAGFxxdZZmxezQ1LEDS3SNX8/Eq4hmikUS494oRTcvsdLCiEs445+uASuG8K+aA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 9, 2024 16:29:15.492516994 CEST	515	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMWQ3OTE0ZGUtZDRlYS00MWZmLTg0NmQtNGExNGMzZGMwY2U0IiwicGFnZV90aW1lIjoxNzI4NDg0MT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	50539	210.157.78.4	80	600	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:29:16.153285027 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: ordercompany.net
Oct 9, 2024 16:29:16.946599007 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 09 Oct 2024 14:29:16 GMT Content-Type: text/html Content-Length: 2814 Connection: close Vary: Accept-Encoding Last-Modified: Thu, 22 Apr 2021 10:24:00 GMT ETag: "afe-5c08d13eb1b03" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 45 55 43 2d 4a 50 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 58 53 45 52 56 45 52 20 49 6e 63 2e 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 4e 44 45 58 2c 46 4f 4c 4c 4f 57 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2a 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="ja"><head><meta charset="EUC-JP" /><title>404 File Not Found</title><meta name="copyright" content="Copyright XSERVER Inc."><meta name="robots" content="INDEX,FOLLOW" /><meta name="viewport" content="width=device-width,initial-scale=1.0,minimum-scale=1.0"><style type="text/css">* { margin: 0; padding: 0;}img { border: 0;}ul { padding-left: 2em;}html { overflow-y: scroll; background: #3b79b7;}body { font-family: "", Meiryo, " ", "MS PGothic", " Pro W3", "Hiragino Kaku Gothic Pro", sans-serif; margin: 0; line-height: 1.4; font-size: 75%; text-align: center; color: white;}h1 { font-size: 24px; font-weight: bold;}h1 { font-weight: bold; line-height: 1; padding-bottom: 20px; font-family: Helvetica, sans-serif;}h2 { text-align: center; font-weight: bold; font-size: 27px;}p { text-align: center; font-size: 14px;
Oct 9, 2024 16:29:16.946628094 CEST	224	IN	Data Raw: 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 77 68 69 74 65 3b 0a 7d 0a 2e 65 78 70 6c 61 69 6e 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 Data Ascii: margin: 0; padding: 0; color: white;}.explain { border-top: 1px solid #fff; border-bottom: 1px solid #fff; line-height: 1.5; margin: 30px auto; padding: 17px;}#cause { text-align: left;
Oct 9, 2024 16:29:16.946638107 CEST	1236	IN	Data Raw: 0a 7d 0a 23 63 61 75 73 65 20 6c 69 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 36 36 36 3b 0a 7d 0a 68 33 20 7b 0a 20 20 20 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 31 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 Data Ascii: }#cause li { color: #666;}h3 { letter-spacing: 1px; font-weight: bold; padding: 0;}#white_box { margin: 15px auto 0; background-color: white;}/* ==================== ======================= *
Oct 9, 2024 16:29:16.946649075 CEST	358	IN	Data Raw: a3 3c 2f 70 3e 0a 20 20 20 20 3c 68 33 3e b0 ca b2 bc a4 ce a4 e8 a4 a6 a4 ca b8 b6 b0 f8 a4 ac b9 cd a4 a8 a4 e9 a4 ec a4 de a4 b9 a1 a3 3c 2f 68 33 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 77 68 69 74 65 5f 62 6f 78 22 3e 0a 20 20 20 20 20 Data Ascii: </p> <h3></h3> <div id="white_box"> <div id="cause"> <ul> <li></li> <li>UR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	50540	185.111.247.38	80	600	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:29:17.160094023 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: leadercompany.net
Oct 9, 2024 16:29:17.945862055 CEST	213	IN	HTTP/1.0 301 Moved Permanently Connection: close content-type: text/html; charset=UTF-8 x-redirect-by: WordPress location: https://leadercompany.net/ content-length: 0 date: Wed, 09 Oct 2024 14:29:16 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	50541	162.43.112.11	80	600	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:29:19.796945095 CEST	81	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: heavycover.net
Oct 9, 2024 16:29:20.620116949 CEST	1236	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Wed, 09 Oct 2024 14:29:20 GMT Content-Type: text/html Content-Length: 7825 Connection: close Vary: Accept-Encoding Last-Modified: Thu, 07 Mar 2019 09:08:00 GMT ETag: "1e91-5837d7168cbbf" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 45 55 43 2d 4a 50 22 20 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 2a 20 7b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0d 0a 7d 0d 0a 69 6d 67 20 7b 0d 0a 20 20 20 20 62 6f 72 64 65 72 3a 20 30 3b 0d 0a 7d 0d 0a 75 6c 20 7b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 65 6d 3b 0d 0a 7d 0d 0a 68 74 6d 6c 20 7b 0d 0a 20 20 20 20 6f 76 65 72 66 6c 6f 77 2d 79 3a 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="ja"><head><meta charset="EUC-JP" /><title>403 Forbidden</title><meta name="viewport" content="width=device-width,initial-scale=1.0,minimum-scale=1.0"><style type="text/css">* { margin: 0; padding: 0;}img { border: 0;}ul { padding-left: 2em;}html { overflow-y: scroll;}body { font-family: "", Meiryo, " ", "MS PGothic", " Pro W3", "Hiragino Kaku Gothic Pro", sans-serif; margin: 0; line-height: 1.4; font-size: 75%; text-align: center; color: rgb(255, 143, 83);}h1 { font-size: 44px; font-weight: bold; font-family: Helvetica, sans-serif; text-align: center;}h2 { text-align: center; font-weight: bold; font-size: 18px;}p { text-align: center; font-size: 14px; margin: 0; padding: 0;}.explain { line-height: 1.5; margin: 30px auto; color: #2f2f2f;}#cause {
Oct 9, 2024 16:29:20.620131969 CEST	224	IN	Data Raw: 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0d 0a 7d 0d 0a 23 63 61 75 73 65 20 6c 69 20 7b 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 66 32 66 32 66 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0d 0a 20 20 Data Ascii: text-align: left;}#cause li { color: #2f2f2f; font-size: 14px; margin-bottom: 0.5em;}#cause li:last-child { margin-bottom: 0;}h3 { letter-spacing: 1px; font-weight: bold; back
Oct 9, 2024 16:29:20.620685101 CEST	1236	IN	Data Raw: 67 72 6f 75 6e 64 3a 20 23 66 66 65 62 65 31 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 35 70 78 3b 0d 0a 7d 0d 0a 23 77 68 69 74 65 5f 62 6f 78 20 7b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 35 70 78 20 61 75 74 6f 20 30 3b 0d 0a 20 20 Data Ascii: ground: #ffebe1; padding: 5px;}#white_box { margin: 15px auto 0; background-color: white;}#base { background: white;}.footer_txt { margin: 10px; padding-bottom: 30px; color: #2f2f2f; font-siz
Oct 9, 2024 16:29:20.620696068 CEST	1236	IN	Data Raw: 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 2f 2a 2d 2d 2d 20 73 61 66 61 72 69 a1 ca 50 43 a1 cb cd d1 20 2d 2d 2d 2a 2f 0d 0a 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e Data Ascii: ebkit-justify-content: center;/--- safariPC ---/ justify-content: center;}#pr-wrap p { margin: 15px;}.explain { font-size: 14px;}h3 { font-size: 16px;}#cause { padding: 10px;}}</style></
Oct 9, 2024 16:29:20.620706081 CEST	1236	IN	Data Raw: 2f 32 39 75 62 62 37 6a 39 42 4b 58 31 37 4c 64 38 6a 6d 6e 33 59 53 43 67 6e 6e 45 36 47 78 72 61 6d 68 6e 5a 67 71 54 31 51 61 52 31 41 4b 51 31 41 4b 50 31 44 67 32 4e 53 43 64 32 63 48 42 77 45 5a 45 51 39 33 63 33 43 47 64 32 66 62 32 39 59 Data Ascii: /29ubb7j9BKX17Ld8jmn3YSCgnnE6GxramhnZgqT1QaR1AKQ1AKP1Dg2NSCd2cHBwEZEQ93c3CGd2fb29Y2Miyqi2/T09PPz89nY2KGgoL6+ve7u7la14vz8/N/f34mIh8fGxjs5OMrJyfr6+mBeXfv7+6inpjk3NmloZ62srNbW1rKxsd7e3vX19To4N8LCwSGe2e/v7/7+/kdFRKuqqVpYV1VTUkJAP0Os3/Ly8tbV1Q+W1py
Oct 9, 2024 16:29:20.620718002 CEST	1236	IN	Data Raw: 62 57 56 75 64 45 6c 45 50 53 4a 34 62 58 41 75 5a 47 6c 6b 4f 6a 6b 35 4e 54 67 7a 4d 6a 49 77 4c 57 4a 6c 4d 7a 49 74 4d 7a 45 30 4f 43 30 35 59 54 4d 32 4c 54 68 6a 4d 6a 49 77 4f 47 51 77 4e 6a 68 6b 4d 79 49 67 65 47 31 77 54 55 30 36 52 47 Data Ascii: bWVudElEPSJ4bXAuZGlkOjk5NTgzMjIwLWJlMzItMzE0OC05YTM2LThjMjIwOGQwNjhkMyIgeG1wTU06RG9jdW1lbnRJRD0ieG1wLmRpZDpFNDk5NUIzQzFEOEIxMUU3OTBCOEU0NDZDMzE4NTM3RiIgeG1wTU06SW5zdGFuY2VJRD0ieG1wLmlpZDpFNDk5NUIzQjFEOEIxMUU3OTBCOEU0NDZDMzE4NTM3RiIgeG1wOkNyZWF
Oct 9, 2024 16:29:20.620728016 CEST	1236	IN	Data Raw: 55 51 4b 30 54 30 74 44 6a 63 42 36 75 43 35 47 45 38 65 51 49 4f 76 46 51 62 42 4f 63 6f 46 49 5a 45 74 6b 77 47 4c 73 52 51 79 65 42 46 61 35 54 61 66 35 64 48 69 44 4c 4e 62 2f 77 5a 35 39 6f 77 41 42 31 78 38 46 46 30 4e 38 31 52 55 71 42 52 Data Ascii: UQK0T0tDjcB6uC5GE8eQIOvFQbBOcoFIZEtkwGLsRQyeBFa5Taf5dHiDLNb/wZ59owAB1x8FF0N81RUqBRxS9LMXPMREJXToDSWoRIQuGByyhRC2+ZDDANYJ5AVvCXSBzTQ/vCEQBPs9Nx0AJTBSSAhTADOQAEFMUoIkXcihAxBd2DGLEyz6MlA8vC2BjEDz7JbXLAkYMBAmIvrnSRQ+dLJKTCNQo9VAG/QARgHlVITBXiGcA9E
Oct 9, 2024 16:29:20.620738029 CEST	426	IN	Data Raw: 63 43 49 38 42 42 48 63 72 31 36 6c 74 2f 59 52 35 42 4e 37 45 55 57 71 74 4e 47 5a 54 73 69 78 69 4f 56 52 53 6a 6d 2b 59 49 4d 75 31 4d 41 59 33 67 43 44 30 49 7a 56 68 45 41 79 61 69 49 6f 41 45 51 34 6f 41 47 41 4f 31 51 42 50 52 46 42 52 50 Data Ascii: cCI8BBHcr16lt/YR5BN7EUWqtNGZTsixiOVRSjm+YIMu1MAY3gCD0IzVhEAyaiIoAEQ4oAGAO1QBPRFBRPKkwYoFkG8ZF2iHdhrRBhqMaRdtaKYNG9GKZfSSHMaMCAaqcAFOQEMUYpHWID4RzTYAMyK/KGcgInKCXEBBF1BIBCAAA4k6lLMNlxhIEsUwZjARVAAEEyRIBpClDN8Y9KApGRIIqiGQJ/CRDOgQgUTlQVCEWvSiFAn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	50542	103.169.142.0	80	600	C:\bamqdjw\erewpegtq.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 16:29:20.774899006 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: gentlecompany.net
Oct 9, 2024 16:29:21.270524979 CEST	679	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 09 Oct 2024 14:29:21 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Wed, 09 Oct 2024 15:29:21 GMT Location: https://gentlecompany.net/index.php expect-ct: max-age=86400, enforce x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block referrer-policy: strict-origin-when-cross-origin Server: cloudflare CF-RAY: 8cff0ff78bd40f63-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Target ID:	0
Start time:	10:27:15
Start date:	09/10/2024
Path:	C:\Users\user\Desktop\25XrVZw56S.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\25XrVZw56S.exe"
Imagebase:	0xfb0000
File size:	442'368 bytes
MD5 hash:	D2965931E5463A26443A022B95EDF5D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:27:16
Start date:	09/10/2024
Path:	C:\bamqdjw\mt2o4nrsazl5davsv.exe
Wow64 process (32bit):	true
Commandline:	"C:\bamqdjw\mt2o4nrsazl5davsv.exe"
Imagebase:	0xcd0000
File size:	442'368 bytes
MD5 hash:	D2965931E5463A26443A022B95EDF5D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 89%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:27:16
Start date:	09/10/2024
Path:	C:\bamqdjw\erewpegtq.exe
Wow64 process (32bit):	true
Commandline:	C:\bamqdjw\erewpegtq.exe
Imagebase:	0xc90000
File size:	442'368 bytes
MD5 hash:	D2965931E5463A26443A022B95EDF5D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 89%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:27:16
Start date:	09/10/2024
Path:	C:\bamqdjw\czmruiag.exe
Wow64 process (32bit):	true
Commandline:	ulazkbbwltmi "c:\bamqdjw\erewpegtq.exe"
Imagebase:	0x180000
File size:	442'368 bytes
MD5 hash:	D2965931E5463A26443A022B95EDF5D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 89%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:27:18
Start date:	09/10/2024
Path:	C:\bamqdjw\erewpegtq.exe
Wow64 process (32bit):	true
Commandline:	"C:\bamqdjw\erewpegtq.exe"
Imagebase:	0xc90000
File size:	442'368 bytes
MD5 hash:	D2965931E5463A26443A022B95EDF5D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:27:38
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:28:35
Start date:	09/10/2024
Path:	C:\bamqdjw\erewpegtq.exe
Wow64 process (32bit):	true
Commandline:	"c:\bamqdjw\erewpegtq.exe"
Imagebase:	0xc90000
File size:	442'368 bytes
MD5 hash:	D2965931E5463A26443A022B95EDF5D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	10:28:35
Start date:	09/10/2024
Path:	C:\bamqdjw\czmruiag.exe
Wow64 process (32bit):	true
Commandline:	ulazkbbwltmi "c:\bamqdjw\erewpegtq.exe"
Imagebase:	0x190000
File size:	442'368 bytes
MD5 hash:	D2965931E5463A26443A022B95EDF5D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	61.7%
Total number of Nodes:	1168
Total number of Limit Nodes:	66

Executed Functions

Function 00FCE9C0 Relevance: 272.4, APIs: 151, Strings: 2, Instructions: 4607libraryloadersleepCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00FCECF9
_memset.LIBCMT ref: 00FCED7D
GetModuleHandleA.KERNEL32(?), ref: 00FCEF7A
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCF009
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCF0CA
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCF194

Part of subcall function 00FD8900: _malloc.LIBCMT ref: 00FD897B

Part of subcall function 00FC5BB0: _memset.LIBCMT ref: 00FC5C01
Part of subcall function 00FC5BB0: _free.LIBCMT ref: 00FC5C43

GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCF2E2
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCF320
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCF35E
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCF39C
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCF3DA
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCF418
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCF47E
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCF4F9
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCF57A
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCF670
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCF6AF
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCF77F
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCF7FC
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCF853
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCF9FD
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCFA3C
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCFA7B
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCFAD8
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCFB4E
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCFBE8
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCFC27
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCFCA7
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCFCE5
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCFD53
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCFD91
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCFDCF
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCFE4A
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCFE89
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCFEC8
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCFF70
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FCFFAE
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD0013
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD0051
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD00B9
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD00F7
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD024B
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD028A
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD02D5
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD0314
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD0353
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD03BC
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD041D
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD04E0
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD054B
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD065A
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD0699
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD0790
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD07D9
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD0838
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD0877
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD08E6
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD0925
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD0964
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD09D3
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD0AE9
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD0BD4
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD0C52
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD0CD9
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD0D2B
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD0D6A
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD0E21
GetProcAddress.KERNEL32(74DD0000,?), ref: 00FD0EA6
LoadLibraryA.KERNELBASE(?), ref: 00FD0EF6
LoadLibraryA.KERNEL32(?), ref: 00FD0F92
GetProcAddress.KERNEL32(74D60000,?), ref: 00FD0FEE
GetProcAddress.KERNEL32(74D60000,?), ref: 00FD102D
GetProcAddress.KERNEL32(74D60000,?), ref: 00FD10E2
GetProcAddress.KERNEL32(74D60000,?), ref: 00FD1131
GetProcAddress.KERNEL32(74D60000,?), ref: 00FD118A
GetProcAddress.KERNEL32(74D60000,?), ref: 00FD11C9
GetProcAddress.KERNEL32(74D60000,?), ref: 00FD1208
GetProcAddress.KERNEL32(74D60000,?), ref: 00FD12B9
GetProcAddress.KERNEL32(74D60000,?), ref: 00FD12F8
GetProcAddress.KERNEL32(74D60000,?), ref: 00FD14DB
GetProcAddress.KERNEL32(74D60000,?), ref: 00FD15E0
GetProcAddress.KERNEL32(74D60000,?), ref: 00FD1634
GetProcAddress.KERNEL32(74D60000,?), ref: 00FD1673
GetProcAddress.KERNEL32(74D60000,?), ref: 00FD16B2
GetProcAddress.KERNEL32(74D60000,?), ref: 00FD1730
GetProcAddress.KERNEL32(74D60000,?), ref: 00FD176E
GetProcAddress.KERNEL32(74D60000,?), ref: 00FD17E5
LoadLibraryA.KERNELBASE(?), ref: 00FD18B9
GetProcAddress.KERNEL32(75A70000,?), ref: 00FD18F8
GetProcAddress.KERNEL32(75A70000,?), ref: 00FD1990
GetProcAddress.KERNEL32(75A70000,?), ref: 00FD19CF
GetProcAddress.KERNEL32(75A70000,?), ref: 00FD1A26
GetProcAddress.KERNEL32(75A70000,?), ref: 00FD1A89
GetProcAddress.KERNEL32(75A70000,?), ref: 00FD1AD8
GetProcAddress.KERNEL32(75A70000,?), ref: 00FD1B3B
GetProcAddress.KERNEL32(75A70000,?), ref: 00FD1BAA
GetProcAddress.KERNEL32(75A70000,?), ref: 00FD1C18
GetProcAddress.KERNEL32(75A70000,?), ref: 00FD1D36
GetProcAddress.KERNEL32(75A70000,?), ref: 00FD1D75
GetProcAddress.KERNEL32(75A70000,?), ref: 00FD1DB4
GetProcAddress.KERNEL32(75A70000,?), ref: 00FD1DF3
GetProcAddress.KERNEL32(75A70000,?), ref: 00FD1E32
GetProcAddress.KERNEL32(75A70000,?), ref: 00FD1E89
GetProcAddress.KERNEL32(75A70000,?), ref: 00FD1EF0
GetProcAddress.KERNEL32(75A70000,?), ref: 00FD1FA7
GetProcAddress.KERNEL32(75A70000,?), ref: 00FD201D
GetProcAddress.KERNEL32(75A70000,?), ref: 00FD205B
GetProcAddress.KERNEL32(75A70000,?), ref: 00FD2118
GetProcAddress.KERNEL32(75A70000,?), ref: 00FD2175
GetProcAddress.KERNEL32(75A70000,?), ref: 00FD21B4
GetProcAddress.KERNEL32(75A70000,?), ref: 00FD21F3
GetProcAddress.KERNEL32(75A70000,?), ref: 00FD2232
GetProcAddress.KERNEL32(75A70000,?), ref: 00FD2299

Part of subcall function 00FB7DE0: GetSystemTime.KERNEL32(?,?,?,?,?,?,00FB74FC), ref: 00FB7E5C
Part of subcall function 00FB7DE0: GetTickCount.KERNEL32 ref: 00FB7EEF

GetEnvironmentVariableA.KERNEL32(?,C:\Users\user,00000104), ref: 00FD233E
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00FD2391
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00FD23AC
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00FD23BD

Part of subcall function 00FD94DD: _malloc.LIBCMT ref: 00FD94F5

GetTickCount.KERNEL32 ref: 00FD2543
__itow.LIBCMT ref: 00FD254A

Part of subcall function 00FCACD0: GetVersionExA.KERNEL32(01016DB8), ref: 00FCAD42
Part of subcall function 00FCACD0: CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00FCAE1E

__stat32i64.LIBCMT ref: 00FD2A37

Part of subcall function 00FDA7E0: ___copy_path_to_wide_string.LIBCMT ref: 00FDA7F5

Sleep.KERNEL32(00000D05), ref: 00FD2A7E
__stat32i64.LIBCMT ref: 00FD2A92

Part of subcall function 00FDA7E0: __wstat64i32.LIBCMT ref: 00FDA80D
Part of subcall function 00FDA7E0: _free.LIBCMT ref: 00FDA817

Sleep.KERNEL32(000007D0), ref: 00FD2C44
__stat32i64.LIBCMT ref: 00FD2C57
GetModuleFileNameA.KERNEL32(00000000,?,00000200), ref: 00FD2C8C
SetFileAttributesA.KERNEL32(00000000,00000080), ref: 00FD2C9B
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00FD2CE0
SetFileAttributesA.KERNEL32(00000000,00000002), ref: 00FD2F2B
SetFileAttributesA.KERNEL32(00000000,00000080), ref: 00FD2F3C
Sleep.KERNEL32(000003E8), ref: 00FD302E
GetCommandLineA.KERNEL32 ref: 00FD3071
GetModuleFileNameA.KERNEL32(00000000,00000000,00000200), ref: 00FD313E
LoadLibraryA.KERNELBASE(?), ref: 00FD3379
GetProcAddress.KERNEL32(?,?), ref: 00FD33B9
MessageBoxA.USER32(00000000,?,?,?), ref: 00FD3490
WSAStartup.WS2_32(00000202,?), ref: 00FD3912

Part of subcall function 00FC1CE0: _strstr.LIBCMT ref: 00FC1CEB

CloseHandle.KERNEL32(00000000), ref: 00FD3AA1
SetFileAttributesA.KERNEL32(?,00000080), ref: 00FD3AB3
CopyFileA.KERNEL32(00000000,?,00000000), ref: 00FD3AC9
SetFileAttributesA.KERNEL32(?,00000002), ref: 00FD3AE0
Sleep.KERNEL32(000003E8), ref: 00FD3B3C

Part of subcall function 00FC4900: _memset.LIBCMT ref: 00FC4A25

Sleep.KERNEL32(000007D0), ref: 00FD3BD1

Part of subcall function 00FDAE47: __fsopen.LIBCMT ref: 00FDAE52

Part of subcall function 00FB2240: Sleep.KERNEL32(000003E8), ref: 00FB22FA

SetFileAttributesA.KERNEL32(01017090,00000080), ref: 00FD3BE3
CopyFileA.KERNEL32(00000000,01017090,00000000), ref: 00FD3BF7
SetFileAttributesA.KERNEL32(01017090,00000002), ref: 00FD3C44

Part of subcall function 00FC6E60: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00FC6EEE
Part of subcall function 00FC6E60: Process32First.KERNEL32(00000000,00000128), ref: 00FC6F71

__snprintf.LIBCMT ref: 00FD3E23
_memset.LIBCMT ref: 00FD3EF4
_memset.LIBCMT ref: 00FD3F0A
CreateThread.KERNEL32(00000000,00000000,Function_00007390,00000000,00000000,00000000), ref: 00FD3F21
Sleep.KERNEL32(0000C350), ref: 00FD3F63
GetCommandLineA.KERNEL32 ref: 00FD263F

Part of subcall function 00FDA5B0: _doexit.LIBCMT ref: 00FDA5BA

Strings

C:\Users\user, xrefs: 00FD2332
q, xrefs: 00FCECD0

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: AddressProc$File$AttributesSleep$Create$_memset$LibraryLoad$CopyModuleMutex__stat32i64_malloc$CommandCountHandleLineNameTick_free$CloseDirectoryEnvironmentFirstMessageProcess32SnapshotStartupSystemThreadTimeToolhelp32VariableVersion___copy_path_to_wide_string__fsopen__itow__snprintf__wstat64i32_doexit_strstr
String ID: C:\Users\user$q
API String ID: 3963012180-181273578
Opcode ID: 6dc53f850369943af7d3401aec66e2ca7aeb9477b3816a8c7a50745632de9f39
Instruction ID: 25b39db02f9e2db8f28af90c955f5e943879a48aef52ad00eb90fd3e2d374c60
Opcode Fuzzy Hash: 6dc53f850369943af7d3401aec66e2ca7aeb9477b3816a8c7a50745632de9f39
Instruction Fuzzy Hash: 4BA3BE71D00A089FC322DF74EC42BA9B775BF8A704F04824AF5896B249EB7E5980DF51

Function 00FCACD0 Relevance: 30.7, APIs: 15, Strings: 2, Instructions: 936
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(01016DB8), ref: 00FCAD42

Part of subcall function 00FBA200: AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00FBA311
Part of subcall function 00FBA200: CheckTokenMembership.KERNELBASE(00000000,?,00000000), ref: 00FBA349

Part of subcall function 00FB6CA0: GetProcAddress.KERNEL32(74DD0000,?), ref: 00FB6CE8
Part of subcall function 00FB6CA0: GetCurrentProcess.KERNEL32(00000000), ref: 00FB6D82

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00FCAE1E
DeleteFileA.KERNELBASE(00000000,?,?,?,?,?,?), ref: 00FCB079
RemoveDirectoryA.KERNELBASE(00000000,?,?,?,?,?,?), ref: 00FCB0D8

Part of subcall function 00FBE620: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00FBE679

CreateDirectoryA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?), ref: 00FCB200
CreateDirectoryA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,?), ref: 00FCB275

Part of subcall function 00FC5BB0: _memset.LIBCMT ref: 00FC5C01
Part of subcall function 00FC5BB0: _free.LIBCMT ref: 00FC5C43

__snprintf.LIBCMT ref: 00FCB516
__snprintf.LIBCMT ref: 00FCB55E
CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00FCB624
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00FCB692
GetTempPathA.KERNEL32(00000104,00000000,?,?,?,?,?,?), ref: 00FCB7D5
CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?), ref: 00FCB8FB

Part of subcall function 00FD8900: _malloc.LIBCMT ref: 00FD897B

Part of subcall function 00FC4360: CreateFileA.KERNELBASE(00000002,40000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00FC4409

GetTempPathA.KERNEL32(00000104,00000000,?,?,?,?,?,?), ref: 00FCBA2E
SetFileAttributesA.KERNELBASE(00000000,00000002,?,?,?,?,?,?,?), ref: 00FCBBEE
_memset.LIBCMT ref: 00FCBCFC

Strings

\, xrefs: 00FCAD7E
C:\Users\user, xrefs: 00FCB4FE, 00FCB546

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: Directory$Create$File$PathTemp__snprintf_memset$AddressAllocateAttributesCheckCurrentDeleteInitializeMembershipProcProcessRemoveTokenVersionWindows_free_malloc
String ID: C:\Users\user$\
API String ID: 3801090003-732849219
Opcode ID: 86541eedbb1b384438bfcb0de3b46e3aeb4602502e3b30725a89af5689b5d61a
Instruction ID: 3a43395cb1460ea2d2593f3a8cf50f27cc2c6199507f5873b9cf9acbe6b74307
Opcode Fuzzy Hash: 86541eedbb1b384438bfcb0de3b46e3aeb4602502e3b30725a89af5689b5d61a
Instruction Fuzzy Hash: AAA2AE75D006498FCB26CFA4DC51BEDB7B1BF8A304F148299E44A7B245EB7A1A84DF40

Function 00FC0E80 Relevance: 9.3, APIs: 6, Instructions: 286
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00FC1037

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: d50c63d4d2296531ffaa48641cfb1572f06ed7fafbdfddaac75403078334405f
Instruction ID: c2431d243683c21be4d0e133d05c5911b2eb00e3e1b7906dae69c46ee31109d5
Opcode Fuzzy Hash: d50c63d4d2296531ffaa48641cfb1572f06ed7fafbdfddaac75403078334405f
Instruction Fuzzy Hash: 26E19D75C006489FCB26CFB9E9416ADBBB1BF8A304F148349E8867B249D77E1985CF50

Function 00FBA200 Relevance: 4.6, APIs: 3, Instructions: 123
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00FBA311
CheckTokenMembership.KERNELBASE(00000000,?,00000000), ref: 00FBA349
FreeSid.ADVAPI32(?), ref: 00FBA42F

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 6a71c2366f273330a78884de527997c8651c6400e332786b2ab53b134a9db61c
Instruction ID: 8fc18b5b4d4a0a712512fe686dfec16d5777591c9c139f228ccf4339041ce20c
Opcode Fuzzy Hash: 6a71c2366f273330a78884de527997c8651c6400e332786b2ab53b134a9db61c
Instruction Fuzzy Hash: 9D515571810A49CEC327CFB9E85136AB774BF9B345F54830AE4867F149EBBE60859B40

Function 00FDEEA4 Relevance: 24.1, APIs: 16, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___security_init_cookie.LIBCMT ref: 00FDEEA4
___crtGetShowWindowMode.LIBCMT ref: 00FDEEBA

Part of subcall function 00FE08F3: GetStartupInfoW.KERNEL32(?), ref: 00FE08FD

_fast_error_exit.LIBCMT ref: 00FDEF1D
_fast_error_exit.LIBCMT ref: 00FDEF2E
__RTC_Initialize.LIBCMT ref: 00FDEF34
__ioinit.LIBCMT ref: 00FDEF3D
_fast_error_exit.LIBCMT ref: 00FDEF48
GetCommandLineA.KERNEL32(01013DE8,00000014), ref: 00FDEF4E
___crtGetEnvironmentStringsA.LIBCMT ref: 00FDEF59
__setargv.LIBCMT ref: 00FDEF63
__amsg_exit.LIBCMT ref: 00FDEF6E
__setenvp.LIBCMT ref: 00FDEF74
__amsg_exit.LIBCMT ref: 00FDEF7F
__cinit.LIBCMT ref: 00FDEF87
__amsg_exit.LIBCMT ref: 00FDEF92
__wincmdln.LIBCMT ref: 00FDEF98

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: __amsg_exit_fast_error_exit$___crt$CommandEnvironmentInfoInitializeLineModeShowStartupStringsWindow___security_init_cookie__cinit__ioinit__setargv__setenvp__wincmdln
String ID:
API String ID: 722230336-0
Opcode ID: 3962b0bc3c76969e73a2bdc703d59d362b93c80a7f356f6f4b4d4d68f1540dfe
Instruction ID: fa41bf34381890e1f175f8c53c53a6e00f92169fe70ff65960d332abdc6fc0af
Opcode Fuzzy Hash: 3962b0bc3c76969e73a2bdc703d59d362b93c80a7f356f6f4b4d4d68f1540dfe
Instruction Fuzzy Hash: FF21E221A0034599EB2077B29D47B2E33566F10762F1C017BF6049F2C3EEBDC941B6A6

Function 00FB8E40 Relevance: 12.3, APIs: 8, Instructions: 271
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FB8EF2
ReadFile.KERNELBASE(000000FF,?,?,?,00000000), ref: 00FB8F17
CloseHandle.KERNEL32(000000FF), ref: 00FB8F35
GetTickCount.KERNEL32 ref: 00FB8F4C

Part of subcall function 00FD8900: _malloc.LIBCMT ref: 00FD897B

_sprintf.LIBCMT ref: 00FB9145
CreateFileA.KERNELBASE(00000001,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00FB916E
WriteFile.KERNELBASE(000000FF,?,?,?,00000000), ref: 00FB91DC
CloseHandle.KERNEL32(000000FF), ref: 00FB91E6

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWrite_malloc_sprintf
String ID:
API String ID: 3359727986-0
Opcode ID: aad98a9d487fe5975cb1debd1e8484cecbd036090f9f8938ab212b8cf3cb79cb
Instruction ID: 3a3e065df7710337677b75553114fbeb526a6da6743cf265318ec96de6090f5b
Opcode Fuzzy Hash: aad98a9d487fe5975cb1debd1e8484cecbd036090f9f8938ab212b8cf3cb79cb
Instruction Fuzzy Hash: A0C18E75D007489FCB16CFE8D851AAEBBB6BF8A300F148209E945BB345D77A6981CF50

Function 00FC7E90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00FC7EFC
CreateProcessA.KERNELBASE(?,00FB1B70,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?), ref: 00FC7F50
CloseHandle.KERNEL32(00FB1B70), ref: 00FC7F5E
CloseHandle.KERNEL32(?), ref: 00FC7F68

Strings

D, xrefs: 00FC7F04

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: CloseHandle$CreateProcess_memset
String ID: D
API String ID: 3113380336-2746444292
Opcode ID: da3fc7866ffdec52a9a191e01a44ea8cc4187ca69fe7d93c776493005d11cf59
Instruction ID: f92e1e5e06c38918bbda0c81026e2a11358058003c265a72cfab876dda7f8357
Opcode Fuzzy Hash: da3fc7866ffdec52a9a191e01a44ea8cc4187ca69fe7d93c776493005d11cf59
Instruction Fuzzy Hash: B0314DB59107089FC722DFB4DC41B99B7B4BFCA704F108219F54AAB288EBBE5581CB14

Function 00FC2280 Relevance: 4.8, APIs: 1, Strings: 1, Instructions: 1305
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00FC3AAC

Strings

q, xrefs: 00FC3EE3

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: _memset
String ID: q
API String ID: 2102423945-389260800
Opcode ID: ed929b1c3610f6e8c13a471552f0e28ccfd33af252a53f008f5a5efcdb1b2804
Instruction ID: d4c3c69277a910b7899985c1e0385e4e36fc67a75d832fc4b89f55e9a2c66f01
Opcode Fuzzy Hash: ed929b1c3610f6e8c13a471552f0e28ccfd33af252a53f008f5a5efcdb1b2804
Instruction Fuzzy Hash: B7F20372810E498EC327CF79E991169B375BFDB385B14C30AE4867F249EBBE50819B44

Function 00FC4360 Relevance: 4.6, APIs: 3, Instructions: 121
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FB1DA0: WaitForSingleObject.KERNEL32(00000108,00004E20,?,?,?,?,00FC686C,00000108), ref: 00FB1EBC

CreateFileA.KERNELBASE(00000002,40000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00FC4409

Part of subcall function 00FB6DF0: ReleaseMutex.KERNEL32(00FC6B5F,?,00FC6B5F,00000108), ref: 00FB6E07

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: CreateFileMutexObjectReleaseSingleWait
String ID:
API String ID: 1564016613-0
Opcode ID: 8b6ba05e5d06e94c9af9f37186a1a23664586238b3b1b39e6bb81e1d6e2e6ed5
Instruction ID: 172454cd575f3ac766edc016f35b8b0ec84953c7153633aa6a4a76039017d53c
Opcode Fuzzy Hash: 8b6ba05e5d06e94c9af9f37186a1a23664586238b3b1b39e6bb81e1d6e2e6ed5
Instruction Fuzzy Hash: 2351BE72900608EFC722CFA5EC51B5AB374AB8A340F10C719F9466B285E77E6680DF90

Function 00FD94DD Relevance: 4.5, APIs: 3, Instructions: 29
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 00FD94F5

Part of subcall function 00FDA6FD: __FF_MSGBANNER.LIBCMT ref: 00FDA714
Part of subcall function 00FDA6FD: __NMSG_WRITE.LIBCMT ref: 00FDA71B
Part of subcall function 00FDA6FD: RtlAllocateHeap.NTDLL(00BB0000,00000000,00000001,00000000,00000000,00000000,?,00FDFCE1,00000000,00000000,00000000,00000000,?,00FE05F7,00000018,01013E08), ref: 00FDA740

std::exception::exception.LIBCMT ref: 00FD9513
__CxxThrowException@8.LIBCMT ref: 00FD9528

Part of subcall function 00FDF37C: RaiseException.KERNEL32(?,?,?,01013AD0,?,?,?,?,?,00FD952D,?,01013AD0,00000000,00000001), ref: 00FDF3D1

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID:
API String ID: 3074076210-0
Opcode ID: 1d12e4050a06b110e91331ff1b114a3a985114299f8b1e62120e002a4d5b29bf
Instruction ID: 55d339f4c5191ce5226192071cf353d38b65fc766bd6e411c04cce869344dafb
Opcode Fuzzy Hash: 1d12e4050a06b110e91331ff1b114a3a985114299f8b1e62120e002a4d5b29bf
Instruction Fuzzy Hash: C5E0E57580420EB6DF10EEE4DC01DAE776EAB01314F184167E805A6281DF709B54B591

Function 00FEE043 Relevance: 3.0, APIs: 2, Instructions: 30
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,?,?,?,?,5EFC4D8B,00000000,00000000,00000000,?,00FEEAA4,?,?,00000000,?,00000000), ref: 00FEE06A
LCMapStringW.KERNEL32(00000000,?,?,?,?,5EFC4D8B,?,00FEEAA4,?,?,00000000,?,00000000,00000000), ref: 00FEE087

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: e9a7ab0bf1aa24bdcc009b23c34adfff7b23f7a828c58a412ca94a18030a4cb0
Instruction ID: 7ab58595ef5af599a10f0c3f8b672075a83942637fcc3095493e070277df736d
Opcode Fuzzy Hash: e9a7ab0bf1aa24bdcc009b23c34adfff7b23f7a828c58a412ca94a18030a4cb0
Instruction Fuzzy Hash: 0DF01F7201014ABFDF169F94EC0ACEA3B7AFB48354B008415FA5945420D7BBA972AB91

Function 00FDA17E Relevance: 3.0, APIs: 2, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00FDA184

Part of subcall function 00FDA14A: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,00FDA189,00000000,?,00FDA72A,000000FF,0000001E,00000000,00000000,00000000,?,00FDFCE1), ref: 00FDA159
Part of subcall function 00FDA14A: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00FDA16B

ExitProcess.KERNEL32 ref: 00FDA18D

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 1c3e0a156b8f2f73cad31ac43c964de29abc83c76356f87b467f295c5b03e39e
Instruction ID: 9c81b252d6c2ded677e4f20e51ec662a8fa4f08871f1a924d220f286fb4fa54e
Opcode Fuzzy Hash: 1c3e0a156b8f2f73cad31ac43c964de29abc83c76356f87b467f295c5b03e39e
Instruction Fuzzy Hash: 6BB09230000108FBCB122F15DC0A8483F2AEB003A0F404421F94808131DBBAA991AA96

Function 00FCA370 Relevance: 1.5, APIs: 1, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FB8E40: CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FB8EF2
Part of subcall function 00FB8E40: ReadFile.KERNELBASE(000000FF,?,?,?,00000000), ref: 00FB8F17
Part of subcall function 00FB8E40: CloseHandle.KERNEL32(000000FF), ref: 00FB8F35
Part of subcall function 00FB8E40: GetTickCount.KERNEL32 ref: 00FB8F4C

Part of subcall function 00FC7E90: _memset.LIBCMT ref: 00FC7EFC
Part of subcall function 00FC7E90: CreateProcessA.KERNELBASE(?,00FB1B70,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?), ref: 00FC7F50
Part of subcall function 00FC7E90: CloseHandle.KERNEL32(00FB1B70), ref: 00FC7F5E
Part of subcall function 00FC7E90: CloseHandle.KERNEL32(?), ref: 00FC7F68

_memset.LIBCMT ref: 00FCA3F1

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: CloseHandle$CreateFile_memset$CountProcessReadTick
String ID:
API String ID: 830835424-0
Opcode ID: ef841c52a1e89a33842aba593103750e78410d9e734037b492910c454d1de200
Instruction ID: 3a05c2e279edeb7dd05c77ebe39e27ac9952be0003644f628301580935bfa64a
Opcode Fuzzy Hash: ef841c52a1e89a33842aba593103750e78410d9e734037b492910c454d1de200
Instruction Fuzzy Hash: A601D67640020A56C314EBA8FC42BE93378EB86705F408295FA088F385FA7E5581C7D5

Function 00FDA5B0 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00FDA5BA

Part of subcall function 00FDA481: __lock.LIBCMT ref: 00FDA48F
Part of subcall function 00FDA481: DecodePointer.KERNEL32(01013D00,0000001C,00FDA36E,00000000,00000001,00000000,?,00FDA2BC,000000FF,?,00FE0530,00000011,?,?,00FE2990,0000000D), ref: 00FDA4CE
Part of subcall function 00FDA481: DecodePointer.KERNEL32(?,00FDA2BC,000000FF,?,00FE0530,00000011,?,?,00FE2990,0000000D), ref: 00FDA4DF
Part of subcall function 00FDA481: EncodePointer.KERNEL32(00000000,?,00FDA2BC,000000FF,?,00FE0530,00000011,?,?,00FE2990,0000000D), ref: 00FDA4F8
Part of subcall function 00FDA481: DecodePointer.KERNEL32(-00000004,?,00FDA2BC,000000FF,?,00FE0530,00000011,?,?,00FE2990,0000000D), ref: 00FDA508
Part of subcall function 00FDA481: EncodePointer.KERNEL32(00000000,?,00FDA2BC,000000FF,?,00FE0530,00000011,?,?,00FE2990,0000000D), ref: 00FDA50E
Part of subcall function 00FDA481: DecodePointer.KERNEL32(?,00FDA2BC,000000FF,?,00FE0530,00000011,?,?,00FE2990,0000000D), ref: 00FDA524
Part of subcall function 00FDA481: DecodePointer.KERNEL32(?,00FDA2BC,000000FF,?,00FE0530,00000011,?,?,00FE2990,0000000D), ref: 00FDA52F

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: 9f2b49ac20845b6f0eb4551c5c54ed72bbf5cf326c5badfbdf990c7c06e7aa43
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: 6BB0123198030C33D9102655FC03F553B0D4741B54F540062FA0C1C2F1B5D3756050CE

Non-executed Functions

Function 00FBE7A0 Relevance: 21.5, APIs: 11, Strings: 1, Instructions: 510memorylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD8900: _malloc.LIBCMT ref: 00FD897B

GetProcessHeap.KERNEL32 ref: 00FBE86C
LoadLibraryA.KERNEL32(?), ref: 00FBE8C8

Part of subcall function 00FC5BB0: _memset.LIBCMT ref: 00FC5C01
Part of subcall function 00FC5BB0: _free.LIBCMT ref: 00FC5C43

GetProcAddress.KERNEL32(00000000,?), ref: 00FBE9D5
FreeLibrary.KERNEL32(00000000), ref: 00FBE9F6
HeapAlloc.KERNEL32(00000000,00000000,00000288), ref: 00FBEA2D
FreeLibrary.KERNEL32(00000000), ref: 00FBEA40
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00FBEA7B
HeapAlloc.KERNEL32(00000000,00000000,00000288), ref: 00FBEA8B
FreeLibrary.KERNEL32(00000000), ref: 00FBEA9E

Strings

o, xrefs: 00FBEA5B

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: FreeHeapLibrary$Alloc$AddressLoadProcProcess_free_malloc_memset
String ID: o
API String ID: 1160571514-252678980
Opcode ID: 3bd0672f816640920835de8c22c0034e3828a4c6944776b3ac5a9921e808bcff
Instruction ID: 7667d55fa35fe759fc3bc5f5ee28702c58c18211b4bcfb982d1073751d5b937b
Opcode Fuzzy Hash: 3bd0672f816640920835de8c22c0034e3828a4c6944776b3ac5a9921e808bcff
Instruction Fuzzy Hash: 1E427871D00648DFCB22CFB9D880AEDBBB1BF8A304F148259E485BB245E77A5985DF50

Function 00FBA5B0 Relevance: 17.3, APIs: 11, Instructions: 816networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD8E80: __time64.LIBCMT ref: 00FD8E87

Part of subcall function 00FD8900: _malloc.LIBCMT ref: 00FD897B

Part of subcall function 00FC5BB0: _memset.LIBCMT ref: 00FC5C01
Part of subcall function 00FC5BB0: _free.LIBCMT ref: 00FC5C43

__snprintf.LIBCMT ref: 00FBADAE
socket.WS2_32(00000002,00000001,00000006), ref: 00FBAF5F
setsockopt.WS2_32(000000FF,0000FFFF,00001006,00000000,00000004), ref: 00FBAF95
gethostbyname.WS2_32(?), ref: 00FBAFA2
inet_ntoa.WS2_32(00000000), ref: 00FBAFEE
inet_addr.WS2_32(00000000), ref: 00FBAFF5
htons.WS2_32(00000050), ref: 00FBB003
connect.WS2_32(000000FF,?,00000010), ref: 00FBB01D
send.WS2_32(000000FF,00000000,00000000,00000000), ref: 00FBB089
recv.WS2_32(000000FF,?,00000400,00000000), ref: 00FBB139
closesocket.WS2_32(000000FF), ref: 00FBB3D1

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: __snprintf__time64_free_malloc_memsetclosesocketconnectgethostbynamehtonsinet_addrinet_ntoarecvsendsetsockoptsocket
String ID:
API String ID: 4080495170-0
Opcode ID: b709bc1197f3f5abe59ad8893c66b5a27e3cc583cba188abf0163a0525cb0953
Instruction ID: 05c44537642f05b04f4b13349192fc15f6688f0b8a3e8bbe85b3ba9103b942ba
Opcode Fuzzy Hash: b709bc1197f3f5abe59ad8893c66b5a27e3cc583cba188abf0163a0525cb0953
Instruction Fuzzy Hash: 67827971900A08DFC722CFB5EC51AAEB775BF8A344F108249E4467B289EB7E5981DF50

Function 00FDF99D Relevance: 16.7, APIs: 11, Instructions: 179COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00FDF9A7
___crtGetLocaleInfoA.LIBCMT ref: 00FDFA20
GetLastError.KERNEL32 ref: 00FDFA32
___crtGetLocaleInfoA.LIBCMT ref: 00FDFA52
__calloc_crt.LIBCMT ref: 00FDFA67
___crtGetLocaleInfoA.LIBCMT ref: 00FDFA94
__calloc_crt.LIBCMT ref: 00FDFAA9
_free.LIBCMT ref: 00FDFAC1
_free.LIBCMT ref: 00FDFB01
__calloc_crt.LIBCMT ref: 00FDFB2B
_free.LIBCMT ref: 00FDFB51

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: InfoLocale___crt__calloc_crt_free$ErrorFeatureLastPresentProcessor
String ID:
API String ID: 4163210287-0
Opcode ID: f57c849764f72c77416599222a40f5f9ba1c075d293310a7a9e0d0d168a5e4c4
Instruction ID: 6b7dcb4472d159c0c5638cdfe84aa84307961162803e6fde9a2bfc1a56bd262a
Opcode Fuzzy Hash: f57c849764f72c77416599222a40f5f9ba1c075d293310a7a9e0d0d168a5e4c4
Instruction Fuzzy Hash: 5E51CA75D0021AABEF219F25DC42FAA7B7AEF14320F1840A7F94DD6241EB35CD54AB60

Function 00FC8DE0 Relevance: 13.6, APIs: 9, Instructions: 132serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 00FC8E53
CreateServiceA.ADVAPI32(00000000,00BC4A48,00BC4A48,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00FC8E94
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00FC8F35
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00FC8F6C
CloseServiceHandle.ADVAPI32(00000000), ref: 00FC8F76
OpenServiceA.ADVAPI32(00000000,00BC4A48,00000010), ref: 00FC8FD5
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00FC8FEC
CloseServiceHandle.ADVAPI32(00000000), ref: 00FC8FF6
CloseServiceHandle.ADVAPI32(00000000), ref: 00FC9000

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
String ID:
API String ID: 3525021261-0
Opcode ID: 8f8ad555f3682e42e93bd8bfe5301ddde7ed5d16276b9bd5d70ab30926a14e97
Instruction ID: e54509d11af6a1307d13bbfbe713088775e11d8d56de57e82d98212f4bf4716f
Opcode Fuzzy Hash: 8f8ad555f3682e42e93bd8bfe5301ddde7ed5d16276b9bd5d70ab30926a14e97
Instruction Fuzzy Hash: 32515E75900B049FC326DFB4EC65B5AB775BBCA741F408209F5866B288EB7F5481CB40

Function 00FC6030 Relevance: 12.2, APIs: 8, Instructions: 183processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00FC6094
Process32First.KERNEL32(00000000,00000128), ref: 00FC6155
__snprintf.LIBCMT ref: 00FC620C
CreateToolhelp32Snapshot.KERNEL32(00000008,?,00000000), ref: 00FC623A
Module32First.KERNEL32(0000000D,00000224), ref: 00FC62A8
CloseHandle.KERNEL32(0000000D,0000000A,?,00FBD9E3), ref: 00FC6311
Process32Next.KERNEL32(00000000,00000128), ref: 00FC632C

Part of subcall function 00FD8900: _malloc.LIBCMT ref: 00FD897B

Part of subcall function 00FC5BB0: _memset.LIBCMT ref: 00FC5C01
Part of subcall function 00FC5BB0: _free.LIBCMT ref: 00FC5C43

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32$CloseHandleModule32Next__snprintf_free_malloc_memset
String ID:
API String ID: 2771089087-0
Opcode ID: 9cf822268585e253b51b0beeba740ef09258df74017714f785e3fe367b4cb702
Instruction ID: fb16c94c29f512903c649b817485ac0d330a2a8904ff0a41335f9393e5511dcb
Opcode Fuzzy Hash: 9cf822268585e253b51b0beeba740ef09258df74017714f785e3fe367b4cb702
Instruction Fuzzy Hash: 8581F071900609DFC726DFB4EC52BADB775BF8A700F008219E549AB248EBBE5681DF50

Function 00FCC5C0 Relevance: 12.2, APIs: 8, Instructions: 169serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00FCC644
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,?,?,00000000), ref: 00FCC6C5
GetLastError.KERNEL32 ref: 00FCC6CE
_malloc.LIBCMT ref: 00FCC70F
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,?,00000000), ref: 00FCC740
__snprintf.LIBCMT ref: 00FCC7A9
_free.LIBCMT ref: 00FCC7EF
CloseServiceHandle.ADVAPI32(00000000), ref: 00FCC7FB

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenService__snprintf_free_malloc
String ID:
API String ID: 3403677689-0
Opcode ID: 4885de482e3cb8b53f34a4cf24decd4807bc010f99737cd12a4b2ede1e3ae3f2
Instruction ID: 82da0c0dd1293b29c9f2bf19f749c1c25fffbe06d18b47485a2ed2961415858c
Opcode Fuzzy Hash: 4885de482e3cb8b53f34a4cf24decd4807bc010f99737cd12a4b2ede1e3ae3f2
Instruction Fuzzy Hash: 82719071D00608DFCB16CFA4DD92BAEB779BF8A340F108219E5067B284E77E5981DB50

Function 00FFEE73 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00FFEE8A
_wcscmp.LIBCMT ref: 00FFEE9B
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00FFF139,?,00000000), ref: 00FFEEB7
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00FFF139,?,00000000), ref: 00FFEEE1

Strings

OCP, xrefs: 00FFEE95
ACP, xrefs: 00FFEE84

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: e12e736815c66e06675ce1229f19a05ec44b1e2297c331d68e405d6f2a898511
Instruction ID: b16272142c028db6cc29f9712f6f8ed632f58fd341dcda8c877dcb6d61baddb3
Opcode Fuzzy Hash: e12e736815c66e06675ce1229f19a05ec44b1e2297c331d68e405d6f2a898511
Instruction Fuzzy Hash: 2601C03224110DAADB21DE69EC05FE6339AAF04774F058425F744DA1B0E734EA80E7D0

Function 00FB3EE0 Relevance: 5.0, Strings: 2, Instructions: 2459COMMON

Download Yara Rule

Strings

`gT, xrefs: 00FB5499
NP9, xrefs: 00FB547A

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID:
String ID: NP9$`gT
API String ID: 0-354968042
Opcode ID: 3b36fb32fa7b6cb5968348bb3943cd994dd7e94389eda9c62de4040656caaa8f
Instruction ID: 5c9ce19b18383def3501eb4c36dd18b066bc7aa4b0a2fd8b8517d5cfdcbeefe5
Opcode Fuzzy Hash: 3b36fb32fa7b6cb5968348bb3943cd994dd7e94389eda9c62de4040656caaa8f
Instruction Fuzzy Hash: 08534C71D00A09DFC71ACFA9D890AADF7B2FFCA344B10C259D456AB249E7396681CF44

Function 00FB7DE0 Relevance: 3.1, APIs: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,?,?,?,?,00FB74FC), ref: 00FB7E5C
GetTickCount.KERNEL32 ref: 00FB7EEF

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: CountSystemTickTime
String ID:
API String ID: 2164215191-0
Opcode ID: 95a7b7f330f3f2eb1be96cae83a966d63f7606cf34e706cd224ee9d163d6893a
Instruction ID: e162a86cfde917da19b3dfa53b008d804a66652ff9ae23a38fbb7eb2d5be76b7
Opcode Fuzzy Hash: 95a7b7f330f3f2eb1be96cae83a966d63f7606cf34e706cd224ee9d163d6893a
Instruction Fuzzy Hash: D3313D71C10B08DEC723DFB4E96066EB775BF8A345F50834AE4467A109EB7E5681DB80

Function 00FE02E8 Relevance: 3.1, APIs: 2, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE031D
IsDebuggerPresent.KERNEL32(?,?,00000000), ref: 00FE03D2

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: DebuggerPresent_memset
String ID:
API String ID: 2328436684-0
Opcode ID: abd28a9d99170fe568d158f674a0a072dd924d7f94dcfe7f1434db8b8f2f72bc
Instruction ID: 244bd217826bdd010b5313d210c449a9e2e64576278be74d947cf430c71ea1bb
Opcode Fuzzy Hash: abd28a9d99170fe568d158f674a0a072dd924d7f94dcfe7f1434db8b8f2f72bc
Instruction Fuzzy Hash: FF31C374C4122C9BCB21DF29D9887CCB7B8BF08310F1042EAE80CA6250EB749BC59F44

Function 00FE0CDC Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00FE03E6,?,?,?,00000000), ref: 00FE0CE1
UnhandledExceptionFilter.KERNEL32(?,?,?,00000000), ref: 00FE0CEA

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0d2dd7a95bbbe8514830ae172207045b1afdc0b2e61f3c3cd3b670660393564f
Instruction ID: 67488c14dce9dcc93dad33ea9b54b06cc2fe42b7df61529eea944205152f1735
Opcode Fuzzy Hash: 0d2dd7a95bbbe8514830ae172207045b1afdc0b2e61f3c3cd3b670660393564f
Instruction Fuzzy Hash: 98B0923508820CEBDB126BD1EC09B5A7F28EB04652F004110F68D441558B7B64208BA1

Function 00FC9630 Relevance: 2.9, Strings: 2, Instructions: 429COMMON

Download Yara Rule

Strings

@, xrefs: 00FC98C2
^5Z, xrefs: 00FC9D87

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID:
String ID: @$^5Z
API String ID: 0-2270632777
Opcode ID: 393e61770606eb7b134163c1d957136161c0d38d9e3acca13d0f586e264a7ed0
Instruction ID: b6b5cddf81c9d406ca0b8d1f5b3aca3e0ae00682591842669b4b26276d14a7c4
Opcode Fuzzy Hash: 393e61770606eb7b134163c1d957136161c0d38d9e3acca13d0f586e264a7ed0
Instruction Fuzzy Hash: A7227D32A00508CFD716CFA9E98169DB7B2FFCA340F24C229E945AB389D77D6941DB44

Function 00FCD5E0 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 00FCD685

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: CtrlDispatcherServiceStart
String ID:
API String ID: 3789849863-0
Opcode ID: 2ff50f86371f8094cc7e2b8f754de3415784835e2196ba9e9b68377269919971
Instruction ID: 64127b6f10fa84d44fb39cb1966e7b1a8b099af6c730c823587d4b1191a277b2
Opcode Fuzzy Hash: 2ff50f86371f8094cc7e2b8f754de3415784835e2196ba9e9b68377269919971
Instruction Fuzzy Hash: 7B010971C00B099AC713DFA5E85566AF775FF8A300F40870AE8457B208EBBE51C59B90

Function 00FEDF03 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(Function_0003DEEF,00000001), ref: 00FEDF31

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 0f374b96c795e7cfe25b0703865a43c1455b6ac9cc6813d91680090967ff8019
Instruction ID: 4c3ec15c5008b514410eeace8cfb820d2c9f47586d432428a4c95d11fb7cf46a
Opcode Fuzzy Hash: 0f374b96c795e7cfe25b0703865a43c1455b6ac9cc6813d91680090967ff8019
Instruction Fuzzy Hash: DFE0B632150248ABDB22DFA5EC45B993BA6AB48724F448011F6885A594C2BFA6619F44

Function 00FEDF89 Relevance: 1.5, APIs: 1, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000002,?,?,00FDFB84,?,?,?,00000002), ref: 00FEDFB0

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: a43df9c12f46151a8da824808ec3d6b6a995294a17e34dda672d8525da02ed94
Instruction ID: 7d5e4714cbaf994be12660c60d22c6b2db6cfc103396fe2b037ad24e0bb022d9
Opcode Fuzzy Hash: a43df9c12f46151a8da824808ec3d6b6a995294a17e34dda672d8525da02ed94
Instruction Fuzzy Hash: F3D06732044149BF8F12AFE5EC098AA3B7AFB48364B444805F95989515D67BA520AB61

Function 00FE0CAB Relevance: 1.5, APIs: 1, Instructions: 6COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00FEBE4A,00FEBDFF,?,00000000,00000000,00000000,00000000), ref: 00FE0CB1

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 98b524a4586fdbbfea87e6f50dd6671b28b8a52e2a6f5b5e0cb8a8fd67bf7ef6
Instruction ID: 4cf47bb93e925ef2340e59aa33dc869d40f92f3deae94af314d6ff119777eebc
Opcode Fuzzy Hash: 98b524a4586fdbbfea87e6f50dd6671b28b8a52e2a6f5b5e0cb8a8fd67bf7ef6
Instruction Fuzzy Hash: 52A0113008820CEBCB022B82EC088883F2CEA002A0B000020F88C002208B2BA8208A80

Function 00FC98B9 Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

@, xrefs: 00FC98C2

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 6677a7709f8b601ba4d0fb18247d4bb4f8a749d58e44368ebca05edd52f7a10d
Instruction ID: 451899a67a709934ace8adb21783f9cef6e0bf3b3b5c9228c11a9ba51cb72c5d
Opcode Fuzzy Hash: 6677a7709f8b601ba4d0fb18247d4bb4f8a749d58e44368ebca05edd52f7a10d
Instruction Fuzzy Hash: C3C16872A00518CBDB19CFACE58169DB7B2FBC9340F24C269D945AB388D738AE41CB44

Function 00FDC499 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 2ef287b5dac05468eabb96643e6bc59d1da433651a9bf8e1f3a284191e68613f
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 32C184326151938ADF2E4639C43413EFAA25EA27B131E175FD4B7CB2D4EE20D524E6E0

Function 00FDC8CE Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: b1113bc7297ff467a8264de1ee88456dc36e89938391ce948e1ed78d6d186459
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 3AC187336151934ADF2E4639C43413EFAA25A927B131E176FD4B7CB2D4EE20C524E5D0

Function 00FDC064 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: cc65f2b7fcb7c28c4356d841b847f88771200ecf233112bb0eed2cd6f087e2f9
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: CEC168326151938ADF2E4639C47413EFAA25AA27B131E076FD4B7CB2D5EE10C524E6E0

Function 00FDBC4C Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 716593799cab1b47972308e910958e9c28f8087b431455834ff9e696f4f7aba8
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 02C185326150938ADF2E4A39C47417EBBA25AA27B131F075FD4B7CB2D4EF10C564E690

Function 00FD9680 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: e923d7d8a84e726db7668fb56bcdd07970a650a33d421bf580066f82093f0de7
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 84112777A0808243D7148EFEC9B46BAA797EBC5330B2D537BD0524BB5CD6A2E945B700

Function 00FC1570 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 194pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32(00000020,?,0000000C,00000000), ref: 00FC1666

Strings

D, xrefs: 00FC16F6

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: CreatePipe
String ID: D
API String ID: 2719314638-2746444292
Opcode ID: c577aa1ddbff5484ed325868e9a25ceea864d1f9e7a41ff5d843abf26dbd23f9
Instruction ID: e7ec0b00bbce56fe7b734029ce6ae81451c2ee0da4d9453f71a6015777820cc0
Opcode Fuzzy Hash: c577aa1ddbff5484ed325868e9a25ceea864d1f9e7a41ff5d843abf26dbd23f9
Instruction Fuzzy Hash: 69815CB5D00708EFDB25DFA4DD45BAEB7B5BF8A300F108209E545AB284DBBE5980CB50

Function 00FE7D00 Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00FE7CE6
DecodePointer.KERNEL32(?,?,?,?,000000FF,?,?,00FB914A,?,?,00000000), ref: 00FE7E59
DecodePointer.KERNEL32(?,?), ref: 00FE7E85
DecodePointer.KERNEL32(?,?), ref: 00FE7EAA
__aulldvrm.LIBCMT ref: 00FE7FE0
_write_multi_char.LIBCMT ref: 00FE80D2
_write_string.LIBCMT ref: 00FE80FB
_write_multi_char.LIBCMT ref: 00FE811D
__cftof.LIBCMT ref: 00FE815B
_write_string.LIBCMT ref: 00FE818C
_write_string.LIBCMT ref: 00FE81C6
_write_multi_char.LIBCMT ref: 00FE81ED
_free.LIBCMT ref: 00FE8206

Strings

g, xrefs: 00FE7E8F
-, xrefs: 00FE807C

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: DecodePointer_write_multi_char_write_string$__aulldvrm__cftof_free_strlen
String ID: -$g
API String ID: 559064418-3991542268
Opcode ID: 0b1a12150436cfd1c260fe4f81ee5b3c82b476be09966424f375f30b9565c98f
Instruction ID: aff559a912d7427a448331377796f204d54d86515699e1c415894f29f0c69e06
Opcode Fuzzy Hash: 0b1a12150436cfd1c260fe4f81ee5b3c82b476be09966424f375f30b9565c98f
Instruction Fuzzy Hash: 21B1EE71D052A99FEF30AB56CC88BA9B7B5FF44360F2401D9E40CA6251DB389E81EF50

Function 00FEFA4C Relevance: 19.6, APIs: 13, Instructions: 84COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00FEFA63

Part of subcall function 00FDFC83: __calloc_impl.LIBCMT ref: 00FDFC92

__calloc_crt.LIBCMT ref: 00FEFA87
_free.LIBCMT ref: 00FEFA95
__calloc_crt.LIBCMT ref: 00FEFAA3
_free.LIBCMT ref: 00FEFAB3
_free.LIBCMT ref: 00FEFAB9
__copytlocinfo_nolock.LIBCMT ref: 00FEFAC8
__wsetlocale_nolock.LIBCMT ref: 00FEFAD5
__setmbcp_nolock.LIBCMT ref: 00FEFAE9
_free.LIBCMT ref: 00FEFAF7
___removelocaleref.LIBCMT ref: 00FEFAFE
___freetlocinfo.LIBCMT ref: 00FEFB05
_free.LIBCMT ref: 00FEFB0B

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 260c3e5d03715550177e9323071f91c8f89fbd3cb0df57945bc4481fc3b93b4d
Instruction ID: b9724589044a10dfddcee05dfd632a3d5048d4576183878f40df18f55846843d
Opcode Fuzzy Hash: 260c3e5d03715550177e9323071f91c8f89fbd3cb0df57945bc4481fc3b93b4d
Instruction Fuzzy Hash: 84218B32504681EAEB213F27DC02E0A7BDADF40BA0B24403EF488491A1DB3D8814B795

Function 00FDA194 Relevance: 18.1, APIs: 12, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00FDA19C
_free.LIBCMT ref: 00FDA1B5

Part of subcall function 00FDA688: RtlFreeHeap.NTDLL(00000000,00000000,?,00FE2938,00000000,00FE0F5F,00FEE22D,00000000,?,00FDFC97,?,?,00000000), ref: 00FDA69C
Part of subcall function 00FDA688: GetLastError.KERNEL32(00000000,?,00FE2938,00000000,00FE0F5F,00FEE22D,00000000,?,00FDFC97,?,?,00000000,?,?,?,00FE2A32), ref: 00FDA6AE

_free.LIBCMT ref: 00FDA1C8
_free.LIBCMT ref: 00FDA1E6
_free.LIBCMT ref: 00FDA1F8
_free.LIBCMT ref: 00FDA209
_free.LIBCMT ref: 00FDA214
_free.LIBCMT ref: 00FDA238
EncodePointer.KERNEL32(00BC2320), ref: 00FDA23F
_free.LIBCMT ref: 00FDA254
_free.LIBCMT ref: 00FDA26A
_free.LIBCMT ref: 00FDA292

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: 64d8062013bed045012343ccff8d6487b3b6b709e30088a1d3fcb78e20802d9e
Instruction ID: 4d55225bee63722af706eefc86149be24b4d9e56b54fde0cda8c5bc1b8bf332b
Opcode Fuzzy Hash: 64d8062013bed045012343ccff8d6487b3b6b709e30088a1d3fcb78e20802d9e
Instruction Fuzzy Hash: 0D218D32D41250CFDB316FA5EC80519776AAB0577171E026BE88897388CB3E9C41EF8A

Function 00FEFB23 Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00FEFBAD
__lock.LIBCMT ref: 00FEFBC3
__copytlocinfo_nolock.LIBCMT ref: 00FEFBD4
__wsetlocale_nolock.LIBCMT ref: 00FEFBEB
_wcscmp.LIBCMT ref: 00FEFC0E
__lock.LIBCMT ref: 00FEFC25
__updatetlocinfoEx_nolock.LIBCMT ref: 00FEFC37
___removelocaleref.LIBCMT ref: 00FEFC3D
__updatetlocinfoEx_nolock.LIBCMT ref: 00FEFC5C

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock_wcscmp
String ID:
API String ID: 1077091919-0
Opcode ID: d970319d11012da773cf7df6d1ddf6d5d8a742357670472928009b1ce9259523
Instruction ID: cdca6ed17db6d64354b5eafbd7f98ad3c858d397ad1aaa7077492c47648acd9f
Opcode Fuzzy Hash: d970319d11012da773cf7df6d1ddf6d5d8a742357670472928009b1ce9259523
Instruction Fuzzy Hash: 60410B32900389ABD710AFAAED42B9D77F1EF44324F24403DF90496142DBBE5649EB51

Function 00FE7EE6 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 202COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00FE7CE6
DecodePointer.KERNEL32(?,?,?,?,000000FF,?,?,00FB914A,?,?,00000000), ref: 00FE7E59
DecodePointer.KERNEL32(?,?), ref: 00FE7E85
DecodePointer.KERNEL32(?,?), ref: 00FE7EAA
__aulldvrm.LIBCMT ref: 00FE7FE0
_write_multi_char.LIBCMT ref: 00FE80D2
_write_string.LIBCMT ref: 00FE80FB
_write_multi_char.LIBCMT ref: 00FE811D
__cftof.LIBCMT ref: 00FE815B
_write_string.LIBCMT ref: 00FE818C
_write_multi_char.LIBCMT ref: 00FE81ED
_free.LIBCMT ref: 00FE8206

Strings

-, xrefs: 00FE807C

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: DecodePointer_write_multi_char$_write_string$__aulldvrm__cftof_free_strlen
String ID: -
API String ID: 1678825546-2547889144
Opcode ID: ceb0f4472a6984bb1c83caa1167ed3bcf480d19cc91b79e325e02a10c75ef682
Instruction ID: 1a9f253ee1282f7459af2d5c9ed075b04176b45cb1ca005e3bfdbb93fd9f927c
Opcode Fuzzy Hash: ceb0f4472a6984bb1c83caa1167ed3bcf480d19cc91b79e325e02a10c75ef682
Instruction Fuzzy Hash: 0871B371E052A99EEF30AB56CC88BA9B7B5EF44350F1400D9D90CA7281DB349F85EF50

Function 00FD9385 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00FD9398

Part of subcall function 00FDF19F: std::exception::_Copy_str.LIBCMT ref: 00FDF1B8

__CxxThrowException@8.LIBCMT ref: 00FD93AD

Part of subcall function 00FDF37C: RaiseException.KERNEL32(?,?,?,01013AD0,?,?,?,?,?,00FD952D,?,01013AD0,00000000,00000001), ref: 00FDF3D1

std::exception::exception.LIBCMT ref: 00FD93C6
__CxxThrowException@8.LIBCMT ref: 00FD93DB
std::regex_error::regex_error.LIBCPMT ref: 00FD93ED

Part of subcall function 00FD905C: std::exception::exception.LIBCMT ref: 00FD9076

__CxxThrowException@8.LIBCMT ref: 00FD93FB
std::exception::exception.LIBCMT ref: 00FD9414
__CxxThrowException@8.LIBCMT ref: 00FD9429

Strings

bad function call, xrefs: 00FD942F

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: afd48d4bda9fe2ad74c5d5b2624b73a4148a74b81483541334f2a2f5e02ad866
Instruction ID: a2d1eae734472ff8a8e384a9564e17c9e64cdda206f44dda78762de0c1a157d3
Opcode Fuzzy Hash: afd48d4bda9fe2ad74c5d5b2624b73a4148a74b81483541334f2a2f5e02ad866
Instruction Fuzzy Hash: 0911BC74C0020CBBCF05FFA5C886CCDBBBDFB14244F448566B9599B245EB78A3499B90

Function 00FB8040 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 308sleepfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC5BB0: _memset.LIBCMT ref: 00FC5C01
Part of subcall function 00FC5BB0: _free.LIBCMT ref: 00FC5C43

GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 00FB839B
__snprintf.LIBCMT ref: 00FB83FE
_memset.LIBCMT ref: 00FB8505
_memset.LIBCMT ref: 00FB851B
Sleep.KERNEL32(00015F90), ref: 00FB8528
DeleteFileA.KERNEL32(?), ref: 00FB8535
_memset.LIBCMT ref: 00FB8549

Strings

rj3., xrefs: 00FB844B

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: _memset$File$DeleteModuleNameSleep__snprintf_free
String ID: rj3.
API String ID: 3733618472-2374996226
Opcode ID: 7e23d9bb2f5471d997a8b9c498692c472dc33b60685fd48644e5773df8a4b9f5
Instruction ID: 30a9cecb2a4deabfce5dcec0da1cecc8ee5d74238f38e08ccb20333af3dedc2e
Opcode Fuzzy Hash: 7e23d9bb2f5471d997a8b9c498692c472dc33b60685fd48644e5773df8a4b9f5
Instruction Fuzzy Hash: 46D1E071C006089FC726DFB9EC81AADB775BFCA304F048219E485AB249EB7E6585DF50

Function 00FE8045 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 00FE80D2
_write_string.LIBCMT ref: 00FE80FB
_write_multi_char.LIBCMT ref: 00FE811D
__cftof.LIBCMT ref: 00FE815B
_write_string.LIBCMT ref: 00FE818C
_write_multi_char.LIBCMT ref: 00FE81ED
_free.LIBCMT ref: 00FE8206

Strings

-, xrefs: 00FE807C

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: _write_multi_char$_write_string$__cftof_free
String ID: -
API String ID: 2964551433-2547889144
Opcode ID: f507755618922d85354abb820563d35445fadce7259c00d7273c23996d589cbe
Instruction ID: 6bbc14e9f51eb5814a29f7495db1dbdef453e93622392a828db916cffd8c6503
Opcode Fuzzy Hash: f507755618922d85354abb820563d35445fadce7259c00d7273c23996d589cbe
Instruction Fuzzy Hash: FC515271E012699EDF31AAA5CC89BE977B5BF08350F0400D9E90CA6291DB399F86DF10

Function 00FE8055 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 00FE80D2
_write_string.LIBCMT ref: 00FE80FB
_write_multi_char.LIBCMT ref: 00FE811D
__cftof.LIBCMT ref: 00FE815B
_write_string.LIBCMT ref: 00FE818C
_write_multi_char.LIBCMT ref: 00FE81ED
_free.LIBCMT ref: 00FE8206

Strings

-, xrefs: 00FE807C

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: _write_multi_char$_write_string$__cftof_free
String ID: -
API String ID: 2964551433-2547889144
Opcode ID: 3347109e46d25c19d8e06fc2ecfa29749a9d3cab0da34901eb119b10fe66e151
Instruction ID: 8681246f04b2c42e146fe1f87aad02716dfcc901901630cc71f41b6bed86387e
Opcode Fuzzy Hash: 3347109e46d25c19d8e06fc2ecfa29749a9d3cab0da34901eb119b10fe66e151
Instruction Fuzzy Hash: 93516271E011699EDF31AAA5CC89BE977B5BF08350F0400D9E90CA6291DB399F86DF10

Function 00FC16AA Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 81processfileCOMMON

Download Yara Rule

APIs

SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 00FC16CF
_memset.LIBCMT ref: 00FC16EE
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 00FC1752
WriteFile.KERNEL32(00000000,00000000,00000020,?,00000000), ref: 00FC178D
CloseHandle.KERNEL32(00000000), ref: 00FC181F
CloseHandle.KERNEL32(00FC56E4), ref: 00FC1829
CloseHandle.KERNEL32(00000020), ref: 00FC1833
CloseHandle.KERNEL32(?), ref: 00FC1843

Strings

D, xrefs: 00FC16F6

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: Handle$Close$CreateFileInformationProcessWrite_memset
String ID: D
API String ID: 3900862288-2746444292
Opcode ID: 49282a383c5ffffaeae7703acd560770bea933bd1d030025c5c40fc3e74560a7
Instruction ID: 594545d87bfc0824f5eedc6198228d40994571c7988164c692c934ff5138c1bc
Opcode Fuzzy Hash: 49282a383c5ffffaeae7703acd560770bea933bd1d030025c5c40fc3e74560a7
Instruction Fuzzy Hash: 0E3149B5E01308EFDB24DFA0DD86BADBBB5BF89310F108119E505AB284D7BA5980CF50

Function 00FC6E60 Relevance: 12.2, APIs: 8, Instructions: 212processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00FC6EEE
Process32First.KERNEL32(00000000,00000128), ref: 00FC6F71
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00FC70A5
TerminateProcess.KERNEL32(00000000,000000FF), ref: 00FC70F8
CloseHandle.KERNEL32(00000000), ref: 00FC7102
Process32Next.KERNEL32(00000000,00000128), ref: 00FC711D
CloseHandle.KERNEL32(00000000), ref: 00FC712F
_memset.LIBCMT ref: 00FC7143

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32_memset
String ID:
API String ID: 3095088415-0
Opcode ID: 154fb655f4703b410233d570908f20aa6bdd9ecdaeb2f4085acd61c1982da9f8
Instruction ID: 8b878c633d378a2810ede46831e6f0a3949b23728cfad1f19435ffd493acefd4
Opcode Fuzzy Hash: 154fb655f4703b410233d570908f20aa6bdd9ecdaeb2f4085acd61c1982da9f8
Instruction Fuzzy Hash: 05B15471C10B498EC726DFB4E8916ADFB75BF8A340F00834AE4827A249EB7E5581CF50

Function 00FC7C00 Relevance: 12.1, APIs: 8, Instructions: 84registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(00BC4A48,Function_00015800), ref: 00FC7C94
SetServiceStatus.ADVAPI32(00000000,01017070), ref: 00FC7CC2
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00FC7CD0
SetServiceStatus.ADVAPI32(00000000,01017070), ref: 00FC7D1E
WaitForSingleObject.KERNEL32(00000000,00001388), ref: 00FC7D2F
SetServiceStatus.ADVAPI32(00000000,01017070), ref: 00FC7D61
CloseHandle.KERNEL32(00000000), ref: 00FC7D6D
SetServiceStatus.ADVAPI32(00000000,01017070), ref: 00FC7DBB

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID:
API String ID: 3399922960-0
Opcode ID: f9b4d7ebf5931d8f86507e7d4bc6dcef8b5d274d6ab5fd40e5d18235e18d94a8
Instruction ID: b4c2ef41505e5e5fa25ecf3d3f5f85a58cc2631dcba05e1389ef9ac7488660b1
Opcode Fuzzy Hash: f9b4d7ebf5931d8f86507e7d4bc6dcef8b5d274d6ab5fd40e5d18235e18d94a8
Instruction Fuzzy Hash: 4F41F6B9940700CFD32ADF70F86AB1677A9B789744F408209F5C29A288D7BF64858B40

Function 00FBDE80 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 278COMMON

Download Yara Rule

Strings

#, xrefs: 00FBE2A3

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 3c8ca988e7c7ef6d7f837081767a8577f541051f15ecd61b8f491b2138b290e6
Instruction ID: f9954cab3ab99f2e323bb37102794bbf17754ea8e1d8c1bc0175a2bcd3a04525
Opcode Fuzzy Hash: 3c8ca988e7c7ef6d7f837081767a8577f541051f15ecd61b8f491b2138b290e6
Instruction Fuzzy Hash: B3C1F271D00209DFCB15CFB9D8516EDB7B2BF86344F248259F446AB285E77A9A80EF40

Function 00FEAF7C Relevance: 10.6, APIs: 7, Instructions: 84COMMON

Download Yara Rule

APIs

___unDName.LIBCMT ref: 00FEAFAB
_strlen.LIBCMT ref: 00FEAFBE
__lock.LIBCMT ref: 00FEAFDA
_malloc.LIBCMT ref: 00FEAFEC
_malloc.LIBCMT ref: 00FEAFFD
_free.LIBCMT ref: 00FEB046

Part of subcall function 00FE047D: IsProcessorFeaturePresent.KERNEL32(00000017,00FE0451,00000000,?,?,?,?,?,00FE045E,00000000,00000000,00000000,00000000,00000000,00FEC360), ref: 00FE047F

_free.LIBCMT ref: 00FEB03F

Part of subcall function 00FDA688: RtlFreeHeap.NTDLL(00000000,00000000,?,00FE2938,00000000,00FE0F5F,00FEE22D,00000000,?,00FDFC97,?,?,00000000), ref: 00FDA69C
Part of subcall function 00FDA688: GetLastError.KERNEL32(00000000,?,00FE2938,00000000,00FE0F5F,00FEE22D,00000000,?,00FDFC97,?,?,00000000,?,?,?,00FE2A32), ref: 00FDA6AE

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: _free_malloc$ErrorFeatureFreeHeapLastNamePresentProcessor___un__lock_strlen
String ID:
API String ID: 3704956918-0
Opcode ID: 9e15ae5f319cdb13ad3c4d2285061a8defcb61ad48a5d43d0a46a8adf8460016
Instruction ID: fc9723be80ecce88f00b78b7e044d1e72a8450684d6dc43d8e3bcc832776e42c
Opcode Fuzzy Hash: 9e15ae5f319cdb13ad3c4d2285061a8defcb61ad48a5d43d0a46a8adf8460016
Instruction Fuzzy Hash: 63212BB1900386EAD721AB359C01B2BB794AF00320F188219F5299B3C2DB78E840E795

Function 00FE29FA Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00FE29FA

Part of subcall function 00FDA3DF: EncodePointer.KERNEL32(00000000,?,00FE29FF,00FDEF28,01013DE8,00000014), ref: 00FDA3E2
Part of subcall function 00FDA3DF: __initp_misc_winsig.LIBCMT ref: 00FDA3FD
Part of subcall function 00FDA3DF: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00FE09A3
Part of subcall function 00FDA3DF: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00FE09B7
Part of subcall function 00FDA3DF: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00FE09CA
Part of subcall function 00FDA3DF: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00FE09DD
Part of subcall function 00FDA3DF: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00FE09F0
Part of subcall function 00FDA3DF: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00FE0A03
Part of subcall function 00FDA3DF: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00FE0A16
Part of subcall function 00FDA3DF: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00FE0A29
Part of subcall function 00FDA3DF: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00FE0A3C
Part of subcall function 00FDA3DF: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00FE0A4F
Part of subcall function 00FDA3DF: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00FE0A62
Part of subcall function 00FDA3DF: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00FE0A75
Part of subcall function 00FDA3DF: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00FE0A88
Part of subcall function 00FDA3DF: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00FE0A9B
Part of subcall function 00FDA3DF: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00FE0AAE
Part of subcall function 00FDA3DF: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00FE0AC1

__mtinitlocks.LIBCMT ref: 00FE29FF
__mtterm.LIBCMT ref: 00FE2A08
__calloc_crt.LIBCMT ref: 00FE2A2D
__initptd.LIBCMT ref: 00FE2A4F
GetCurrentThreadId.KERNEL32 ref: 00FE2A56

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: AddressProc$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm
String ID:
API String ID: 1593083391-0
Opcode ID: 62c9337ca4afa24e3d4afea2179814f5e37b0d5dee362b877459aa155a350e45
Instruction ID: dfa470b6c09de1030c9cea942cd084fd5890216c781c59a6f0d45a5d61407c91
Opcode Fuzzy Hash: 62c9337ca4afa24e3d4afea2179814f5e37b0d5dee362b877459aa155a350e45
Instruction Fuzzy Hash: 45F0F0329292D15DE6B4BB767C0365A36899B01B30F20063AF4A5D50D2FF9D8981B284

Function 00FC1D00 Relevance: 9.3, APIs: 6, Instructions: 252fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FC1F5C
_memset.LIBCMT ref: 00FC221F

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: CreateFile_memset
String ID:
API String ID: 3830271748-0
Opcode ID: 9dce2c593ab0351d36786dcc7df63db637bf3e47477bea43ee1093fc72329093
Instruction ID: 5a6dffd6d6a215704638b6318e3b3eb00e025a113045350e6523314d686e194a
Opcode Fuzzy Hash: 9dce2c593ab0351d36786dcc7df63db637bf3e47477bea43ee1093fc72329093
Instruction Fuzzy Hash: AAC15872910A099AC322CF76ED41699B375BFCA345F14870AE5827F189EBBE6084DB00

Function 00FC67C0 Relevance: 9.2, APIs: 6, Instructions: 201libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(75A70000,?), ref: 00FC6898
GetProcAddress.KERNEL32(75A70000,?), ref: 00FC68CD
_rand.LIBCMT ref: 00FC69C9
_rand.LIBCMT ref: 00FC69D1
_rand.LIBCMT ref: 00FC6A2E
_rand.LIBCMT ref: 00FC6A36

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: _rand$AddressProc
String ID:
API String ID: 345958962-0
Opcode ID: 9155862f32daac82daeb9dbf2732074f7dc6c6208783213d6fc71b370e26f3eb
Instruction ID: 3c0fc8fc11642303d5dbbb38741533c0d12ed01077ad5412df676df3e90aa831
Opcode Fuzzy Hash: 9155862f32daac82daeb9dbf2732074f7dc6c6208783213d6fc71b370e26f3eb
Instruction Fuzzy Hash: ED91BE72900A04CFC322DFB8ED42A69B771BBCA345F04831AE485AF289E77F5480DB54

Function 00FC5000 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 439COMMON

Download Yara Rule

Strings

, xrefs: 00FC5674
, xrefs: 00FC5322

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: _free_memset
String ID: $
API String ID: 287624719-227171996
Opcode ID: bee27ed29d9352118fe5ae4da1ee818334942c9ab87a39b38c7e2614857c973e
Instruction ID: f0b19ba5b614cbf27a50a179b4154b6304b9e4bc9f09fc48c8c34588e9f63a37
Opcode Fuzzy Hash: bee27ed29d9352118fe5ae4da1ee818334942c9ab87a39b38c7e2614857c973e
Instruction Fuzzy Hash: 1112B171D00A099FCB16DFB8EC51AADB771BF8A304F048219E4457B249EB3E6585DF50

Function 00FEF363 Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00FEF8FF

Part of subcall function 00FE050D: __mtinitlocknum.LIBCMT ref: 00FE051F
Part of subcall function 00FE050D: __amsg_exit.LIBCMT ref: 00FE052B
Part of subcall function 00FE050D: EnterCriticalSection.KERNEL32(?,?,00FE2990,0000000D), ref: 00FE0538

_free.LIBCMT ref: 00FEF925

Part of subcall function 00FDA688: RtlFreeHeap.NTDLL(00000000,00000000,?,00FE2938,00000000,00FE0F5F,00FEE22D,00000000,?,00FDFC97,?,?,00000000), ref: 00FDA69C
Part of subcall function 00FDA688: GetLastError.KERNEL32(00000000,?,00FE2938,00000000,00FE0F5F,00FEE22D,00000000,?,00FDFC97,?,?,00000000,?,?,?,00FE2A32), ref: 00FDA6AE

__lock.LIBCMT ref: 00FEF93E
___removelocaleref.LIBCMT ref: 00FEF94D
___freetlocinfo.LIBCMT ref: 00FEF966
_free.LIBCMT ref: 00FEF979

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: 79e4de376166247c6ff827819736a25a437df1517009994696f2ee4122f8ab3b
Instruction ID: a554620da20e04cb0d87ad54aff42b4ef0cab131e6dfdd61bb2eb615b8060f53
Opcode Fuzzy Hash: 79e4de376166247c6ff827819736a25a437df1517009994696f2ee4122f8ab3b
Instruction Fuzzy Hash: 1401C431902380A6EA347F66DC01B5D73959F01731F29422DF0D5AA1D2CB7C8988F995

Function 00FB94B0 Relevance: 7.7, APIs: 5, Instructions: 197synchronizationCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,01017440,00000104), ref: 00FB9599
_memset.LIBCMT ref: 00FB966E
GetTickCount.KERNEL32 ref: 00FB96A4
__vfwprintf_p.LIBCMT ref: 00FB975A
ReleaseMutex.KERNEL32(00000100), ref: 00FB9790

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: CountFileModuleMutexNameReleaseTick__vfwprintf_p_memset
String ID:
API String ID: 2753155262-0
Opcode ID: 2a366220aab8f3ae76d1c3a16ba2af9966c9c42dc1fbe1bb1a628b54701b4536
Instruction ID: a8541823dd048c954558e43c6caed4f8ba623713aa8492717c45f212de4e95e8
Opcode Fuzzy Hash: 2a366220aab8f3ae76d1c3a16ba2af9966c9c42dc1fbe1bb1a628b54701b4536
Instruction Fuzzy Hash: D181C0B1D006489FCB11CFB5EC82AADBBB1BF8A304F048219E5457B245E7BE6584CF51

Function 00FC9EE0 Relevance: 7.7, APIs: 5, Instructions: 196processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00FCA00D
Process32First.KERNEL32(00000000,00000128), ref: 00FCA04D
Process32Next.KERNEL32(00000000,00000128), ref: 00FCA206
CloseHandle.KERNEL32(00000000), ref: 00FCA218
_memset.LIBCMT ref: 00FCA261

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memset
String ID:
API String ID: 2526126748-0
Opcode ID: 7f081ee24f99b74981441dc0a6c07c019b1b5819d944bfdd1ed45a0ad071eb1a
Instruction ID: 58e2cd154f69539d2e2ce008da4489b938fb1e4b896b7a07a4f8ada29da59089
Opcode Fuzzy Hash: 7f081ee24f99b74981441dc0a6c07c019b1b5819d944bfdd1ed45a0ad071eb1a
Instruction Fuzzy Hash: 93A17875C00609CECB26CFB5E9816EDB7B1BF8A308F148249E4857B248E77E2585CF94

Function 00FCA690 Relevance: 7.6, APIs: 5, Instructions: 120fileCOMMON

Download Yara Rule

APIs

std::ios_base::good.LIBCPMTD ref: 00FCA74F
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00FCA7A2
std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 00FCA7B1
DeleteFileA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00FB7A5E), ref: 00FCA7BE
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00FCA828

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: Affinity::operator!=Concurrency::details::Hardware$DeleteFileMutex_baseMutex_base::~_std::_std::ios_base::good
String ID:
API String ID: 1152012751-0
Opcode ID: 1cf971669a1e543d68f9fd399fc8b1ab93223e2a6970504171f1480339ca282a
Instruction ID: 89f4330fada112878c8b4260baaac8013e629d635fd9251066a9faf099b64345
Opcode Fuzzy Hash: 1cf971669a1e543d68f9fd399fc8b1ab93223e2a6970504171f1480339ca282a
Instruction Fuzzy Hash: 4051B03181020DDEC71AEB72ED52AEEB374BF96304B148259E4427B055FB3D2684EF50

Function 01003B77 Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 01003BB2
_strlen.LIBCMT ref: 01003BC0

Part of subcall function 00FE0F5A: __getptd_noexit.LIBCMT ref: 00FE0F5A

_strnlen.LIBCMT ref: 01003C4B
__lock.LIBCMT ref: 01003C5C
__getenv_helper_nolock.LIBCMT ref: 01003C67

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: f34cbd5cc490f85e7afe00d0a955aa3278d7905553dbcd90b4d417e2feb4ebca
Instruction ID: 2c310695f2cf9990af70800fde27d5dc319ea1f6c46ca89052395dc156ece759
Opcode Fuzzy Hash: f34cbd5cc490f85e7afe00d0a955aa3278d7905553dbcd90b4d417e2feb4ebca
Instruction Fuzzy Hash: F831CA32604666AEFB236A6A9C01BAE7794BF05B24F140065FA45DF2C1DF78894057D1

Function 00FEE0FD Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00FEE109

Part of subcall function 00FDA6FD: __FF_MSGBANNER.LIBCMT ref: 00FDA714
Part of subcall function 00FDA6FD: __NMSG_WRITE.LIBCMT ref: 00FDA71B
Part of subcall function 00FDA6FD: RtlAllocateHeap.NTDLL(00BB0000,00000000,00000001,00000000,00000000,00000000,?,00FDFCE1,00000000,00000000,00000000,00000000,?,00FE05F7,00000018,01013E08), ref: 00FDA740

_free.LIBCMT ref: 00FEE11C

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 2c0c389fb1f5f7c0a295461d1edbe7f0447f2855dcef52c6f60027bd42bfb922
Instruction ID: 545420f2d8b56f7c40354ee567b460b244d0bacbf4c48f7995d47b03436f2176
Opcode Fuzzy Hash: 2c0c389fb1f5f7c0a295461d1edbe7f0447f2855dcef52c6f60027bd42bfb922
Instruction Fuzzy Hash: 27110633905295AACB313F76BC047693798DF043B0F144526F9998A281DE7D88E0BB94

Function 00FB9D40 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00FB9DBA
CreateThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00FB9DD5
CloseHandle.KERNEL32(?), ref: 00FB9DE2
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00FB9DF0
CloseHandle.KERNEL32(00000000,?,000000FF), ref: 00FB9DFC

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: c6b3a9edacb64026d1b923bf83fc0121ee57ddc992f8862074dd28d6599c214d
Instruction ID: 4a550c462ded0dc782ec0dd6f66165470df70078462b23199de075fb1beb7897
Opcode Fuzzy Hash: c6b3a9edacb64026d1b923bf83fc0121ee57ddc992f8862074dd28d6599c214d
Instruction Fuzzy Hash: 99213E74A00208EFC721DFA4DD85B59B7B5FF8A300F108245F845AB384D77AA980DF50

Function 00FBD7B0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 307COMMON

Download Yara Rule

APIs

__snprintf.LIBCMT ref: 00FBD8D3
_memset.LIBCMT ref: 00FBD906
_memset.LIBCMT ref: 00FBDD04

Strings

C:\Users\user, xrefs: 00FBD90E

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: _memset$__snprintf
String ID: C:\Users\user
API String ID: 1922369481-2179397983
Opcode ID: aace15bdc459ba817bd665b2b0537c8c0643744b3e60ee8c6cafa3fcb43a286e
Instruction ID: cbeafc970ebbdaeee10b7ff1b20e391e0065380e69ad12c885bbee5250c1cd7d
Opcode Fuzzy Hash: aace15bdc459ba817bd665b2b0537c8c0643744b3e60ee8c6cafa3fcb43a286e
Instruction Fuzzy Hash: F2D1D072810A089EC326EFB5EC52AADB334BF96744F048219F5467B14AFB7E2185DF50

Function 00FD5D20 Relevance: 6.3, APIs: 4, Instructions: 252COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00FD5F63
_malloc.LIBCMT ref: 00FD5FB4

Part of subcall function 00FDA6FD: __FF_MSGBANNER.LIBCMT ref: 00FDA714
Part of subcall function 00FDA6FD: __NMSG_WRITE.LIBCMT ref: 00FDA71B
Part of subcall function 00FDA6FD: RtlAllocateHeap.NTDLL(00BB0000,00000000,00000001,00000000,00000000,00000000,?,00FDFCE1,00000000,00000000,00000000,00000000,?,00FE05F7,00000018,01013E08), ref: 00FDA740

_memset.LIBCMT ref: 00FD60D6
_free.LIBCMT ref: 00FD60E4

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: _malloc$AllocateHeap_free_memset
String ID:
API String ID: 3974598690-0
Opcode ID: 2fb3dc3afbdd931615b2d136eac8e5496d57782fc6c59b75ae54564d899f685b
Instruction ID: f2758cc73b3c3fbd237b62cd2d9db3355f629380dcaf4fed312b0dceb0fce63e
Opcode Fuzzy Hash: 2fb3dc3afbdd931615b2d136eac8e5496d57782fc6c59b75ae54564d899f685b
Instruction Fuzzy Hash: 92C16D71900608DFC726CF69E880559B7B2FFCA344B18C60AE885AF349E77EA584DF54

Function 00FED34E Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00FED3DF
_memmove.LIBCMT ref: 00FED453
___AdjustPointer.LIBCMT ref: 00FED4A4
_memmove.LIBCMT ref: 00FED4AD

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: AdjustPointer_memmove
String ID:
API String ID: 1721217611-0
Opcode ID: f74806b169935982078a136d19476f384d7f3e64b2f00dcb9c502f07c1b6acba
Instruction ID: 329d10cf73bb1d7adca9a8c089ba8328340d1d47d08abcfce9f8b630cfefec03
Opcode Fuzzy Hash: f74806b169935982078a136d19476f384d7f3e64b2f00dcb9c502f07c1b6acba
Instruction Fuzzy Hash: 8141B5726043865FEB34AF16DC41F6A37E59F15720F28401EF9448A9E2EB76F980F611

Function 00FF2AF4 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00FF2B2A
__isleadbyte_l.LIBCMT ref: 00FF2B58
MultiByteToWideChar.KERNEL32(00000000,00000009,00000004,00000002,00000000,00000000), ref: 00FF2B86
MultiByteToWideChar.KERNEL32(00000000,00000009,00000004,00000001,00000000,00000000), ref: 00FF2BBC

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: a9986aa4e5efd2b8553ba4faf1483664c254e587a3c0e2a47967dfa858b9f3b6
Instruction ID: 54c4d097d4fd7bd45be919f6d3e37e93fb5ffc8c48da74fdcf7d1f1169239406
Opcode Fuzzy Hash: a9986aa4e5efd2b8553ba4faf1483664c254e587a3c0e2a47967dfa858b9f3b6
Instruction Fuzzy Hash: 1631D231A0024AAFDB668F25CC84BBA7BB5FF80320F154128EE54871A0E734D891EB90

Function 00FB3D80 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00FB3DB2

Part of subcall function 00FDA6FD: __FF_MSGBANNER.LIBCMT ref: 00FDA714
Part of subcall function 00FDA6FD: __NMSG_WRITE.LIBCMT ref: 00FDA71B
Part of subcall function 00FDA6FD: RtlAllocateHeap.NTDLL(00BB0000,00000000,00000001,00000000,00000000,00000000,?,00FDFCE1,00000000,00000000,00000000,00000000,?,00FE05F7,00000018,01013E08), ref: 00FDA740

_memset.LIBCMT ref: 00FB3DDA
_memset.LIBCMT ref: 00FB3E25
_free.LIBCMT ref: 00FB3E34

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: _memset$AllocateHeap_free_malloc
String ID:
API String ID: 585861054-0
Opcode ID: 08c058015e7275539fc6b2bd0a67ceb209c4afa5a805f824461c2a015f822414
Instruction ID: 3514bd56419f828941550f51c8d45a78549374f59f5815e5d2124c35c55b7ced
Opcode Fuzzy Hash: 08c058015e7275539fc6b2bd0a67ceb209c4afa5a805f824461c2a015f822414
Instruction Fuzzy Hash: A8318AB9900608EFC711CF24D881A9AB766AF89340F14C349F8495F345D73AEA85DB80

Function 00FEF368 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00FE28C0: __getptd_noexit.LIBCMT ref: 00FE28C1
Part of subcall function 00FE28C0: __amsg_exit.LIBCMT ref: 00FE28CE

__calloc_crt.LIBCMT ref: 00FEF9B6

Part of subcall function 00FDFC83: __calloc_impl.LIBCMT ref: 00FDFC92

__lock.LIBCMT ref: 00FEF9EC
___addlocaleref.LIBCMT ref: 00FEF9F8
__lock.LIBCMT ref: 00FEFA0C

Part of subcall function 00FE0F5A: __getptd_noexit.LIBCMT ref: 00FE0F5A

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 0f517400f434fefc3feed2f59bca2da20268d79911f59e45e43119a470dcd01e
Instruction ID: 15f43671cb22326a9d91663ffca83d6984b2fbf62a749f8ecd40a0e788f286b6
Opcode Fuzzy Hash: 0f517400f434fefc3feed2f59bca2da20268d79911f59e45e43119a470dcd01e
Instruction Fuzzy Hash: 8F01B9315013819BD720BFB69C03F5D77E19F41720F20415AF4999B2D2CE7C4A85BBA1

Function 00FEB304 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00FEB328

Part of subcall function 00FEBA48: __fltout2.LIBCMT ref: 00FEBA71

__cftog_l.LIBCMT ref: 00FEB34E
__cftoe_l.LIBCMT ref: 00FEB380

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 8f8e10958419399f40c41451e010b0b0e7d1fa157c85eca3f2f0a7d36c385075
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 3701497244018AFFCF125E86DC068EE3F66BB19354B598515FA2898131D336C9B2BB82

Function 00FECBB4 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 00FECBCB

Part of subcall function 00FED2C0: ___AdjustPointer.LIBCMT ref: 00FED309

_UnwindNestedFrames.LIBCMT ref: 00FECBE2
___FrameUnwindToState.LIBCMT ref: 00FECBF4
CallCatchBlock.LIBCMT ref: 00FECC18

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: 2d8c29e931c82cb4b179de0235233341f27f52423f207cbaa2e250d67f1f5fc6
Instruction ID: fa4dd5ed611bc57cd542c783438b2bd42dd7b008303e50944b483111429ee886
Opcode Fuzzy Hash: 2d8c29e931c82cb4b179de0235233341f27f52423f207cbaa2e250d67f1f5fc6
Instruction Fuzzy Hash: AB014C32400149BBCF126F6ACC01EDA3FBAFF88754F144015FD1866221D336E862EBA1

Function 00FB7390 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

Z, xrefs: 00FB76E2

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: CountSystemTickTime_malloc
String ID: Z
API String ID: 3770554779-1505515367
Opcode ID: 62caf45af4004c76b5aa6fef9772e8c2ebf62323d9c5f766ee80ad951c5042d7
Instruction ID: 1ed638a51ed4d7047c40b2301ec0205d65e69d3dd9dee13f995c4b6364e26525
Opcode Fuzzy Hash: 62caf45af4004c76b5aa6fef9772e8c2ebf62323d9c5f766ee80ad951c5042d7
Instruction Fuzzy Hash: 1A12AF71C00A089FC722DFB5EC51AADB775BF8A340F14821AE44A7B245EB7E1A85DF50

Function 00FB76A3 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 279sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000008AE), ref: 00FB7A4D

Part of subcall function 00FD8900: _malloc.LIBCMT ref: 00FD897B

Part of subcall function 00FC5BB0: _memset.LIBCMT ref: 00FC5C01
Part of subcall function 00FC5BB0: _free.LIBCMT ref: 00FC5C43

_memset.LIBCMT ref: 00FB79B3

Strings

Z, xrefs: 00FB76E2

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: _memset$Sleep_free_malloc
String ID: Z
API String ID: 3151160524-1505515367
Opcode ID: b24d31c2375c7173ac55f55a41a506d694318bfbdb941cbb2d66eae1744f21da
Instruction ID: d66b9ccb95d534268bc9ddf84f06cd189129965a2745b74487628413c091f02e
Opcode Fuzzy Hash: b24d31c2375c7173ac55f55a41a506d694318bfbdb941cbb2d66eae1744f21da
Instruction Fuzzy Hash: 3BC1AF76C00608DFCB16DFA5EC81AEDB375BF89300F04825AE549BB245EB796A84DF50

Function 00FBE1E6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00FBE2F6
_memcmp.LIBCMT ref: 00FBE314

Strings

#, xrefs: 00FBE2A3

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: _memcmp
String ID: #
API String ID: 2931989736-1885708031
Opcode ID: 234c355a9f05e6329691c226727b7bd96f9ae795f4fd5bdef55b51d644a41ded
Instruction ID: 9d8f13a9f6e914322c2bed4dfd592d312522caad1c32f419ecf0d070caa121a4
Opcode Fuzzy Hash: 234c355a9f05e6329691c226727b7bd96f9ae795f4fd5bdef55b51d644a41ded
Instruction Fuzzy Hash: 72317C72C10A09CBC722DFB4E8116D9B7B6BFDB344F148315E5867E109E77E54829B40

Function 00FC1799 Relevance: 5.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000), ref: 00FC181F
CloseHandle.KERNEL32(00FC56E4), ref: 00FC1829
CloseHandle.KERNEL32(00000020), ref: 00FC1833
CloseHandle.KERNEL32(?), ref: 00FC1843

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: d8560ca7d35cf7697df7d1b3ccacbdb0db4d31c29cc1d1a8d1b43c20672ab160
Instruction ID: 3565758cdd11bac97b28feb793a2e19c63fe2104cc6c64b08e155377bfee9321
Opcode Fuzzy Hash: d8560ca7d35cf7697df7d1b3ccacbdb0db4d31c29cc1d1a8d1b43c20672ab160
Instruction Fuzzy Hash: 07F03075D02209DFCB20DFE1EA49BBE7775BB85311F404948E50156384CB7E5990DF91

Function 00FC1766 Relevance: 5.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000), ref: 00FC181F
CloseHandle.KERNEL32(00FC56E4), ref: 00FC1829
CloseHandle.KERNEL32(00000020), ref: 00FC1833
CloseHandle.KERNEL32(?), ref: 00FC1843

Memory Dump Source

Source File: 00000000.00000002.1732740292.0000000000FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1732727175.0000000000FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732776155.0000000001007000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001015000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732792726.0000000001019000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732822467.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_25XrVZw56S.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 7ee0b48c6751455d996666ce36b8d9461584d874d7220b656a37770d17477d29
Instruction ID: 3565758cdd11bac97b28feb793a2e19c63fe2104cc6c64b08e155377bfee9321
Opcode Fuzzy Hash: 7ee0b48c6751455d996666ce36b8d9461584d874d7220b656a37770d17477d29
Instruction Fuzzy Hash: 07F03075D02209DFCB20DFE1EA49BBE7775BB85311F404948E50156384CB7E5990DF91

Analysis Process: mt2o4nrsazl5davsv.exePID: 7120, Parent PID: 7072COMMON

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4%
Total number of Nodes:	1392
Total number of Limit Nodes:	84

Executed Functions

Function 00CEE9C0 Relevance: 270.6, APIs: 150, Strings: 2, Instructions: 4607libraryloadersleepCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00CEECF9
_memset.LIBCMT ref: 00CEED7D
GetModuleHandleA.KERNEL32(?), ref: 00CEEF7A
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEF009
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEF0CA
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEF194

Part of subcall function 00CF8900: _malloc.LIBCMT ref: 00CF897B

Part of subcall function 00CE5BB0: _memset.LIBCMT ref: 00CE5C01
Part of subcall function 00CE5BB0: _free.LIBCMT ref: 00CE5C43

GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEF2E2
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEF320
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEF35E
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEF39C
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEF3DA
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEF418
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEF47E
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEF4F9
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEF57A
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEF670
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEF6AF
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEF77F
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEF7FC
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEF853
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEF9FD
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEFA3C
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEFA7B
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEFAD8
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEFB4E
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEFBE8
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEFC27
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEFCA7
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEFCE5
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEFD53
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEFD91
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEFDCF
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEFE4A
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEFE89
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEFEC8
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEFF70
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CEFFAE
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF0013
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF0051
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF00B9
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF00F7
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF024B
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF028A
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF02D5
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF0314
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF0353
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF03BC
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF041D
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF04E0
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF054B
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF065A
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF0699
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF0790
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF07D9
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF0838
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF0877
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF08E6
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF0925
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF0964
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF09D3
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF0AE9
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF0BD4
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF0C52
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF0CD9
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF0D2B
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF0D6A
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF0E21
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CF0EA6
LoadLibraryA.KERNELBASE(?), ref: 00CF0EF6
LoadLibraryA.KERNEL32(?), ref: 00CF0F92
GetProcAddress.KERNEL32(74D60000,?), ref: 00CF0FEE
GetProcAddress.KERNEL32(74D60000,?), ref: 00CF102D
GetProcAddress.KERNEL32(74D60000,?), ref: 00CF10E2
GetProcAddress.KERNEL32(74D60000,?), ref: 00CF1131
GetProcAddress.KERNEL32(74D60000,?), ref: 00CF118A
GetProcAddress.KERNEL32(74D60000,?), ref: 00CF11C9
GetProcAddress.KERNEL32(74D60000,?), ref: 00CF1208
GetProcAddress.KERNEL32(74D60000,?), ref: 00CF12B9
GetProcAddress.KERNEL32(74D60000,?), ref: 00CF12F8
GetProcAddress.KERNEL32(74D60000,?), ref: 00CF14DB
GetProcAddress.KERNEL32(74D60000,?), ref: 00CF15E0
GetProcAddress.KERNEL32(74D60000,?), ref: 00CF1634
GetProcAddress.KERNEL32(74D60000,?), ref: 00CF1673
GetProcAddress.KERNEL32(74D60000,?), ref: 00CF16B2
GetProcAddress.KERNEL32(74D60000,?), ref: 00CF1730
GetProcAddress.KERNEL32(74D60000,?), ref: 00CF176E
GetProcAddress.KERNEL32(74D60000,?), ref: 00CF17E5
LoadLibraryA.KERNELBASE(?), ref: 00CF18B9
GetProcAddress.KERNEL32(75A70000,?), ref: 00CF18F8
GetProcAddress.KERNEL32(75A70000,?), ref: 00CF1990
GetProcAddress.KERNEL32(75A70000,?), ref: 00CF19CF
GetProcAddress.KERNEL32(75A70000,?), ref: 00CF1A26
GetProcAddress.KERNEL32(75A70000,?), ref: 00CF1A89
GetProcAddress.KERNEL32(75A70000,?), ref: 00CF1AD8
GetProcAddress.KERNEL32(75A70000,?), ref: 00CF1B3B
GetProcAddress.KERNEL32(75A70000,?), ref: 00CF1BAA
GetProcAddress.KERNEL32(75A70000,?), ref: 00CF1C18
GetProcAddress.KERNEL32(75A70000,?), ref: 00CF1D36
GetProcAddress.KERNEL32(75A70000,?), ref: 00CF1D75
GetProcAddress.KERNEL32(75A70000,?), ref: 00CF1DB4
GetProcAddress.KERNEL32(75A70000,?), ref: 00CF1DF3
GetProcAddress.KERNEL32(75A70000,?), ref: 00CF1E32
GetProcAddress.KERNEL32(75A70000,?), ref: 00CF1E89
GetProcAddress.KERNEL32(75A70000,?), ref: 00CF1EF0
GetProcAddress.KERNEL32(75A70000,?), ref: 00CF1FA7
GetProcAddress.KERNEL32(75A70000,?), ref: 00CF201D
GetProcAddress.KERNEL32(75A70000,?), ref: 00CF205B
GetProcAddress.KERNEL32(75A70000,?), ref: 00CF2118
GetProcAddress.KERNEL32(75A70000,?), ref: 00CF2175
GetProcAddress.KERNEL32(75A70000,?), ref: 00CF21B4
GetProcAddress.KERNEL32(75A70000,?), ref: 00CF21F3
GetProcAddress.KERNEL32(75A70000,?), ref: 00CF2232
GetProcAddress.KERNEL32(75A70000,?), ref: 00CF2299

Part of subcall function 00CD7DE0: GetSystemTime.KERNEL32(?,?,?,?,?,?,00CD74FC), ref: 00CD7E5C
Part of subcall function 00CD7DE0: GetTickCount.KERNEL32 ref: 00CD7EEF

GetEnvironmentVariableA.KERNEL32(?,C:\Users\user,00000104), ref: 00CF233E
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00CF2391
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00CF23AC
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00CF23BD

Part of subcall function 00CF94DD: _malloc.LIBCMT ref: 00CF94F5

GetTickCount.KERNEL32 ref: 00CF2543
__itow.LIBCMT ref: 00CF254A

Part of subcall function 00CEACD0: GetVersionExA.KERNEL32(00D36DB8), ref: 00CEAD42
Part of subcall function 00CEACD0: CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00CEAE1E

__stat32i64.LIBCMT ref: 00CF2A37

Part of subcall function 00CFA7E0: ___copy_path_to_wide_string.LIBCMT ref: 00CFA7F5

Sleep.KERNEL32(00000D05), ref: 00CF2A7E
__stat32i64.LIBCMT ref: 00CF2A92

Part of subcall function 00CFA7E0: __wstat64i32.LIBCMT ref: 00CFA80D
Part of subcall function 00CFA7E0: _free.LIBCMT ref: 00CFA817

Sleep.KERNEL32(000007D0), ref: 00CF2C44
__stat32i64.LIBCMT ref: 00CF2C57
GetModuleFileNameA.KERNEL32(00000000,?,00000200), ref: 00CF2C8C
SetFileAttributesA.KERNEL32(00000000,00000080), ref: 00CF2C9B
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00CF2CE0
SetFileAttributesA.KERNEL32(00000000,00000002), ref: 00CF2F2B
SetFileAttributesA.KERNEL32(00000000,00000080), ref: 00CF2F3C
Sleep.KERNEL32(000003E8), ref: 00CF302E
GetCommandLineA.KERNEL32 ref: 00CF3071
GetModuleFileNameA.KERNEL32(00000000,00000000,00000200), ref: 00CF313E
LoadLibraryA.KERNEL32(?), ref: 00CF3379
GetProcAddress.KERNEL32(?,?), ref: 00CF33B9
WSAStartup.WS2_32(00000202,?), ref: 00CF3912

Part of subcall function 00CE1CE0: _strstr.LIBCMT ref: 00CE1CEB

CloseHandle.KERNEL32(00000114), ref: 00CF3AA1
SetFileAttributesA.KERNELBASE(?,00000080), ref: 00CF3AB3
CopyFileA.KERNEL32(00000000,?,00000000), ref: 00CF3AC9
SetFileAttributesA.KERNELBASE(?,00000002), ref: 00CF3AE0
Sleep.KERNELBASE(000003E8), ref: 00CF3B3C

Part of subcall function 00CE4900: _memset.LIBCMT ref: 00CE4A25

Sleep.KERNEL32(000007D0), ref: 00CF3BD1

Part of subcall function 00CFAE47: __fsopen.LIBCMT ref: 00CFAE52

Part of subcall function 00CD2240: Sleep.KERNEL32(000003E8), ref: 00CD22FA

SetFileAttributesA.KERNEL32(C:\bamqdjw\czmruiag.exe,00000080), ref: 00CF3BE3
CopyFileA.KERNEL32(00000000,C:\bamqdjw\czmruiag.exe,00000000), ref: 00CF3BF7
SetFileAttributesA.KERNEL32(C:\bamqdjw\czmruiag.exe,00000002), ref: 00CF3C44

Part of subcall function 00CE6E60: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00CE6EEE
Part of subcall function 00CE6E60: Process32First.KERNEL32(00000000,00000128), ref: 00CE6F71

__snprintf.LIBCMT ref: 00CF3E23
_memset.LIBCMT ref: 00CF3EF4
_memset.LIBCMT ref: 00CF3F0A
CreateThread.KERNEL32(00000000,00000000,Function_00007390,00000000,00000000,00000000), ref: 00CF3F21
Sleep.KERNEL32(0000C350), ref: 00CF3F63
GetCommandLineA.KERNEL32 ref: 00CF263F

Part of subcall function 00CFA5B0: _doexit.LIBCMT ref: 00CFA5BA

Strings

C:\bamqdjw\czmruiag.exe, xrefs: 00CF3799, 00CF3819, 00CF3BDE, 00CF3BEB, 00CF3C3F, 00CF3ED9
C:\Users\user, xrefs: 00CF2332

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: AddressProc$File$AttributesSleep$Create$_memset$LibraryLoad$CopyModuleMutex__stat32i64_malloc$CommandCountHandleLineNameTick_free$CloseDirectoryEnvironmentFirstProcess32SnapshotStartupSystemThreadTimeToolhelp32VariableVersion___copy_path_to_wide_string__fsopen__itow__snprintf__wstat64i32_doexit_strstr
String ID: C:\Users\user$C:\bamqdjw\czmruiag.exe
API String ID: 3228906957-2192419724
Opcode ID: 6a2993e93b286f81341e390015ee4030833e58aa1c35423e73431e36d549415e
Instruction ID: 04d3c4eb20090a1f82767b281f45f88d8fe1e9d807c6a34506e32c6af2b5189b
Opcode Fuzzy Hash: 6a2993e93b286f81341e390015ee4030833e58aa1c35423e73431e36d549415e
Instruction Fuzzy Hash: BCA3BAB1900B089FC756CF74FC41BA9B7B4BF99341F008259E509E636AEBB15A81CF61

Function 00CDE7A0 Relevance: 25.0, APIs: 13, Strings: 1, Instructions: 510
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CF8900: _malloc.LIBCMT ref: 00CF897B

GetProcessHeap.KERNEL32 ref: 00CDE86C
LoadLibraryA.KERNELBASE(?), ref: 00CDE8C8

Part of subcall function 00CE5BB0: _memset.LIBCMT ref: 00CE5C01
Part of subcall function 00CE5BB0: _free.LIBCMT ref: 00CE5C43

GetProcAddress.KERNEL32(00000000,?), ref: 00CDE9D5
FreeLibrary.KERNEL32(00000000), ref: 00CDE9F6
HeapAlloc.KERNEL32(00000000,00000000,00000288), ref: 00CDEA2D
FreeLibrary.KERNEL32(00000000), ref: 00CDEA40
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 00CDEA55
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00CDEA7B
HeapAlloc.KERNEL32(00000000,00000000,00000288), ref: 00CDEA8B
FreeLibrary.KERNEL32(00000000), ref: 00CDEA9E

Strings

o, xrefs: 00CDEA5B

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: FreeHeapLibrary$Alloc$AdaptersAddressInfoLoadProcProcess_free_malloc_memset
String ID: o
API String ID: 1543936905-252678980
Opcode ID: 6c47473ae26289128500f03b5d26738198bc00f15669dbf32425ead828f5fb71
Instruction ID: df2cf9bac07516b749f43fe592ecd6426682ab051385c8039c009f727d52633c
Opcode Fuzzy Hash: 6c47473ae26289128500f03b5d26738198bc00f15669dbf32425ead828f5fb71
Instruction Fuzzy Hash: CC428774D00B489FCB16CFA9E8806AEBBB1BF99300F14825AD505BB365E7716985CF60

Function 00CE8DE0 Relevance: 13.6, APIs: 9, Instructions: 132
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.SECHOST(00000000,00000000,00000002), ref: 00CE8E53
CreateServiceA.ADVAPI32(00000000,00A318C8,00A318C8,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00CE8E94
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00CE8F35
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00CE8F6C
CloseServiceHandle.ADVAPI32(00000000), ref: 00CE8F76
OpenServiceA.ADVAPI32(00000000,00A318C8,00000010), ref: 00CE8FD5
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00CE8FEC
CloseServiceHandle.ADVAPI32(00000000), ref: 00CE8FF6
CloseServiceHandle.ADVAPI32(00000000), ref: 00CE9000

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
String ID:
API String ID: 3525021261-0
Opcode ID: 92b58a301d63711a54f26b6d0201542fd73969f479c40ac0702ee5ffe48cebd1
Instruction ID: c1fce2f9955cc4d7ff404b1e6ba2349c8631c3501e7fb3478a6754b6fb236a4c
Opcode Fuzzy Hash: 92b58a301d63711a54f26b6d0201542fd73969f479c40ac0702ee5ffe48cebd1
Instruction Fuzzy Hash: 4951F875900F08AEC30ADFB4FC65B5AB775BB89741F108219E506E73A8EB719481CB64

Function 00CE67C0 Relevance: 12.2, APIs: 8, Instructions: 201
libraryencryptionloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75A70000,?), ref: 00CE6898
GetProcAddress.KERNEL32(75A70000,?), ref: 00CE68CD
CryptAcquireContextA.ADVAPI32(00D375B0,00000000,00000000,00000001,00000000), ref: 00CE692D
CryptGenRandom.ADVAPI32(00000000,00000004,00CD888B,?,?,?,?,?,?,?,?,?,?,?,?,00CD888B), ref: 00CE69A8
_rand.LIBCMT ref: 00CE69C9
_rand.LIBCMT ref: 00CE69D1
_rand.LIBCMT ref: 00CE6A2E
_rand.LIBCMT ref: 00CE6A36

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: _rand$AddressCryptProc$AcquireContextRandom
String ID:
API String ID: 3501257216-0
Opcode ID: 4556fe446d52a5d219a18898bc273fd1a72697dce69685bd2719ad0339db7993
Instruction ID: 16b20c3b0a15d5c20868ee27ab8b926f1557d9ea3ae5ac7f4c2f34fc03411e43
Opcode Fuzzy Hash: 4556fe446d52a5d219a18898bc273fd1a72697dce69685bd2719ad0339db7993
Instruction Fuzzy Hash: 31918AB1810F488FC31ACF79FD41669B7B5BB99381B048219E505EB3A9E7715481CB74

Function 00CEACD0 Relevance: 30.7, APIs: 15, Strings: 2, Instructions: 936
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00D36DB8), ref: 00CEAD42

Part of subcall function 00CDA200: AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00CDA311
Part of subcall function 00CDA200: CheckTokenMembership.ADVAPI32(00000000,?,00000000), ref: 00CDA349

Part of subcall function 00CD6CA0: GetProcAddress.KERNEL32(74DD0000,?), ref: 00CD6CE8
Part of subcall function 00CD6CA0: GetCurrentProcess.KERNEL32(00000000), ref: 00CD6D82

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00CEAE1E
DeleteFileA.KERNELBASE(00000000,?,?,?,?,?,?), ref: 00CEB079
RemoveDirectoryA.KERNELBASE(00000000,?,?,?,?,?,?), ref: 00CEB0D8

Part of subcall function 00CDE620: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00CDE679

CreateDirectoryA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?), ref: 00CEB200
CreateDirectoryA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,?), ref: 00CEB275

Part of subcall function 00CE5BB0: _memset.LIBCMT ref: 00CE5C01
Part of subcall function 00CE5BB0: _free.LIBCMT ref: 00CE5C43

__snprintf.LIBCMT ref: 00CEB516
__snprintf.LIBCMT ref: 00CEB55E
CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00CEB624
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00CEB692
GetTempPathA.KERNEL32(00000104,00000000,?,?,?,?,?,?), ref: 00CEB7D5
CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?), ref: 00CEB8FB

Part of subcall function 00CF8900: _malloc.LIBCMT ref: 00CF897B

Part of subcall function 00CE4360: CreateFileA.KERNELBASE(00000002,40000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00CE4409

GetTempPathA.KERNEL32(00000104,00000000,?,?,?,?,?,?), ref: 00CEBA2E
SetFileAttributesA.KERNELBASE(00000000,00000002,?,?,?,?,?,?,?), ref: 00CEBBEE
_memset.LIBCMT ref: 00CEBCFC

Strings

\, xrefs: 00CEAD7E
C:\Users\user, xrefs: 00CEB4FE, 00CEB546

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: Directory$Create$File$PathTemp__snprintf_memset$AddressAllocateAttributesCheckCurrentDeleteInitializeMembershipProcProcessRemoveTokenVersionWindows_free_malloc
String ID: C:\Users\user$\
API String ID: 3801090003-732849219
Opcode ID: 172d1f14d8897213d85a39167ea01bc2786010265ea1629f27eaebcc13fa762f
Instruction ID: 74fb2cdb26ff5f1fe388ddfc44c2692558a6d28742c29662b1769bf255c16bb0
Opcode Fuzzy Hash: 172d1f14d8897213d85a39167ea01bc2786010265ea1629f27eaebcc13fa762f
Instruction Fuzzy Hash: 15A27975C00B588FCB15CFA8EC91BADBBB1BF49304F148299E50AA7355EB705A84CF60

Function 00CFEEA4 Relevance: 24.1, APIs: 16, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___security_init_cookie.LIBCMT ref: 00CFEEA4
___crtGetShowWindowMode.LIBCMT ref: 00CFEEBA

Part of subcall function 00D008F3: GetStartupInfoW.KERNEL32(?), ref: 00D008FD

_fast_error_exit.LIBCMT ref: 00CFEF1D
_fast_error_exit.LIBCMT ref: 00CFEF2E
__RTC_Initialize.LIBCMT ref: 00CFEF34
__ioinit.LIBCMT ref: 00CFEF3D
_fast_error_exit.LIBCMT ref: 00CFEF48
GetCommandLineA.KERNEL32(00D33DE8,00000014), ref: 00CFEF4E
___crtGetEnvironmentStringsA.LIBCMT ref: 00CFEF59
__setargv.LIBCMT ref: 00CFEF63
__amsg_exit.LIBCMT ref: 00CFEF6E
__setenvp.LIBCMT ref: 00CFEF74
__amsg_exit.LIBCMT ref: 00CFEF7F
__cinit.LIBCMT ref: 00CFEF87
__amsg_exit.LIBCMT ref: 00CFEF92
__wincmdln.LIBCMT ref: 00CFEF98

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: __amsg_exit_fast_error_exit$___crt$CommandEnvironmentInfoInitializeLineModeShowStartupStringsWindow___security_init_cookie__cinit__ioinit__setargv__setenvp__wincmdln
String ID:
API String ID: 722230336-0
Opcode ID: f33e24f5fce0d328b89405ff3d9267bc88f36df400a5dac1908dbad45bedd63a
Instruction ID: 07f5a1f2fd995623989cf9ed835f90158a73eff02f02fc3d5b302d9d54afbfad
Opcode Fuzzy Hash: f33e24f5fce0d328b89405ff3d9267bc88f36df400a5dac1908dbad45bedd63a
Instruction Fuzzy Hash: 9421D36164530D69EBF077F5994BB3D2154EF10711F20417AF70C9A1E2DEB4D941A273

Function 00CE1D00 Relevance: 9.3, APIs: 6, Instructions: 252
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CE1F5C
_memset.LIBCMT ref: 00CE221F

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: CreateFile_memset
String ID:
API String ID: 3830271748-0
Opcode ID: 0dc1cb4e85abdacc07489c752f9493ed21d9368df3c8bb9e163e531c85f39c72
Instruction ID: efaa409a68380cb9eff695b4b12f04925782412b32e117120a205d4555b878f1
Opcode Fuzzy Hash: 0dc1cb4e85abdacc07489c752f9493ed21d9368df3c8bb9e163e531c85f39c72
Instruction Fuzzy Hash: 29C18972810F489AC706CF7AFC81659B375FF99781B148706E502FA3A9EBB06185DF60

Function 00CE7E90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00CE7EFC
CreateProcessA.KERNELBASE(?,00CD1B70,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?), ref: 00CE7F50
CloseHandle.KERNEL32(00CD1B70), ref: 00CE7F5E
CloseHandle.KERNEL32(?), ref: 00CE7F68

Strings

D, xrefs: 00CE7F04

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: CloseHandle$CreateProcess_memset
String ID: D
API String ID: 3113380336-2746444292
Opcode ID: 79d2dc2aff009aa9e5d42d630fdaba1c4a3e4818ed4ecc94bdf68d36251a4569
Instruction ID: 752f0b032a898b006a94fb622ebec5850200cb901f3bab950a38b39090aa827d
Opcode Fuzzy Hash: 79d2dc2aff009aa9e5d42d630fdaba1c4a3e4818ed4ecc94bdf68d36251a4569
Instruction Fuzzy Hash: 0D3150B5910B08AFC701CFB8EC41B99B7B4BF89744F108715E50AFB3A4E7B0A5818B24

Function 00CE8370 Relevance: 5.0, APIs: 3, Instructions: 544
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameA.KERNEL32(?,00000010), ref: 00CE8480
_memset.LIBCMT ref: 00CE883F

Part of subcall function 00CDC910: _memset.LIBCMT ref: 00CDC96A

Part of subcall function 00CE5770: _memset.LIBCMT ref: 00CE579A

Part of subcall function 00CD2510: __snprintf.LIBCMT ref: 00CD266B
Part of subcall function 00CD2510: __snprintf.LIBCMT ref: 00CD26AD

Part of subcall function 00CE5980: Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00CE59E9

_memset.LIBCMT ref: 00CE8D40

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: _memset$__snprintf$Affinity::operator!=ComputerConcurrency::details::HardwareName
String ID:
API String ID: 3175924889-0
Opcode ID: 50c5a9bdfb2330403ead91b2ca2a0cbc4c0a661dae491d53c31d780b561870d4
Instruction ID: 1c38c83a0667538005267fa88812e3e7d2ccf5792c79cc6479162981c5d0e204
Opcode Fuzzy Hash: 50c5a9bdfb2330403ead91b2ca2a0cbc4c0a661dae491d53c31d780b561870d4
Instruction Fuzzy Hash: 98426971C00B488EC716DFB8EC916ADBB75BF99340F10825AE40AB7365EB712586CF60

Function 00CE4900 Relevance: 4.7, APIs: 3, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00CE4A25
_memset.LIBCMT ref: 00CE4BBE
_memset.LIBCMT ref: 00CE4BE8

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 16704879869d13abcf7d6e32054633736b8f8a0d6484f42f43bc1284d3cf7f3f
Instruction ID: 080011c047a0518b29ff6c9eb4a87f457e1f884320d33f977bfe54841e7a0269
Opcode Fuzzy Hash: 16704879869d13abcf7d6e32054633736b8f8a0d6484f42f43bc1284d3cf7f3f
Instruction Fuzzy Hash: 0681BC71C00B488FCB0ADFBAF8416ADB771AF99344F148619E506B73A5E7706984CFA1

Function 00CDA200 Relevance: 4.6, APIs: 3, Instructions: 123
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00CDA311
CheckTokenMembership.ADVAPI32(00000000,?,00000000), ref: 00CDA349
FreeSid.ADVAPI32(?), ref: 00CDA42F

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 7391f8c8c20868a594e29c597d9d39ee28197348b6fcac9e86722f9cba592b6a
Instruction ID: b5dfa96d275259446342d8143ce2615f7e36c3c5cbc8c0aa7751c537e997340b
Opcode Fuzzy Hash: 7391f8c8c20868a594e29c597d9d39ee28197348b6fcac9e86722f9cba592b6a
Instruction Fuzzy Hash: 4D514671810F098EC306CF79FC5135AB774BF9A385F54830AD506FA369EBB191828B65

Function 00CE4360 Relevance: 4.6, APIs: 3, Instructions: 121
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CD1DA0: WaitForSingleObject.KERNEL32(00000108,00004E20,?,?,?,?,00CE686C,00000108), ref: 00CD1EBC

CreateFileA.KERNELBASE(00000002,40000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00CE4409

Part of subcall function 00CD6DF0: ReleaseMutex.KERNEL32(00CE6B5F,?,00CE6B5F,00000108), ref: 00CD6E07

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: CreateFileMutexObjectReleaseSingleWait
String ID:
API String ID: 1564016613-0
Opcode ID: 09d1f5917f400d4137c3a35e9d007e6c53175cc4ce02084d359c9fba997d25aa
Instruction ID: 068e76d2f9bf9c41d3ecc0769de3319519c20f99aad99bdf19b029552c7ae008
Opcode Fuzzy Hash: 09d1f5917f400d4137c3a35e9d007e6c53175cc4ce02084d359c9fba997d25aa
Instruction Fuzzy Hash: DB518D75900B48EFC705CFA6FC81B5AB374AF88740F10C619E506A73A5E775AA84DFA0

Function 00CF94DD Relevance: 4.5, APIs: 3, Instructions: 29
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 00CF94F5

Part of subcall function 00CFA6FD: __FF_MSGBANNER.LIBCMT ref: 00CFA714
Part of subcall function 00CFA6FD: __NMSG_WRITE.LIBCMT ref: 00CFA71B
Part of subcall function 00CFA6FD: RtlAllocateHeap.NTDLL(00A20000,00000000,00000001,00000000,00000000,00000000,?,00CFFCE1,00000000,00000000,00000000,00000000,?,00D005F7,00000018,00D33E08), ref: 00CFA740

std::exception::exception.LIBCMT ref: 00CF9513
__CxxThrowException@8.LIBCMT ref: 00CF9528

Part of subcall function 00CFF37C: RaiseException.KERNEL32(?,?,?,00D33AD0,?,?,?,?,?,00CF952D,?,00D33AD0,00000000,00000001), ref: 00CFF3D1

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID:
API String ID: 3074076210-0
Opcode ID: cff0873c5e0c497d46665ddd4d5722adaffbade0fb46eb005700f08ffdcd4c41
Instruction ID: a3e9a560a4d767e19918599cbfe7490c694846fdf7fe580da47ae8837b411ec6
Opcode Fuzzy Hash: cff0873c5e0c497d46665ddd4d5722adaffbade0fb46eb005700f08ffdcd4c41
Instruction Fuzzy Hash: BFE0E57040021EAACF40FF64DC119FE7B6CEF10308F004026FA25A6191DF708B55A5A3

Function 00CE1A50 Relevance: 3.1, APIs: 2, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 00CE1BA2
_memset.LIBCMT ref: 00CE1BD4

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: CreateFile_memset
String ID:
API String ID: 3830271748-0
Opcode ID: d0996011785909f7aff37bdcdb090ec47f0736a28c7729383dad6984cc6c337c
Instruction ID: 10048c6493f34f3e7cabdb45eef06a539f71f7c35f83566d74953324303c6d2f
Opcode Fuzzy Hash: d0996011785909f7aff37bdcdb090ec47f0736a28c7729383dad6984cc6c337c
Instruction Fuzzy Hash: 1541D174D007489FCB15CFA5EC42BEEB7B1AF45310F048259E915B7391E7B42688CB61

Function 00D0E043 Relevance: 3.0, APIs: 2, Instructions: 30
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,?,?,?,?,5EFC4D8B,00000000,00000000,00000000,?,00D0EAA4,?,?,00000000,?,00000000), ref: 00D0E06A
LCMapStringW.KERNEL32(00000000,?,?,?,?,5EFC4D8B,?,00D0EAA4,?,?,00000000,?,00000000,00000000), ref: 00D0E087

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: a8d2925dc542290eb2477a875f8409bc0b5f9190e845bbc620e03a7e968a33cb
Instruction ID: 5451ac72ffa53e2e8329238bce5bced5056a0f94b7b31283a12e4ca9dc25df65
Opcode Fuzzy Hash: a8d2925dc542290eb2477a875f8409bc0b5f9190e845bbc620e03a7e968a33cb
Instruction Fuzzy Hash: 0DF01472010209BFDF065F94ED46DAA3B6AFB58350B048415FA1985160D772A972AB60

Function 00CFA17E Relevance: 3.0, APIs: 2, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00CFA184

Part of subcall function 00CFA14A: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,00CFA189,00000000,?,00CFA72A,000000FF,0000001E,00000000,00000000,00000000,?,00CFFCE1), ref: 00CFA159
Part of subcall function 00CFA14A: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00CFA16B

ExitProcess.KERNEL32 ref: 00CFA18D

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 49669b96f5a03a2fa495522d9b05fe8c29c6d6729954f349996019c10ad21e17
Instruction ID: a5fe5b9069037ea5a549c3dd1fcf2e6c2281646f34c5cb046c4cb290321b7dc8
Opcode Fuzzy Hash: 49669b96f5a03a2fa495522d9b05fe8c29c6d6729954f349996019c10ad21e17
Instruction Fuzzy Hash: 38B0923000420CFFCB212F15DD0A85C7F29EB012A0B118020FA0948131DB72A992AAA2

Function 00CE2280 Relevance: 2.8, APIs: 1, Instructions: 1305COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CE3AAC

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 71a82b9465efe88467356a1ebfe8692d7bc248a74da184a9ce126eebc39bc19f
Instruction ID: 8c9394fddd9eebbea2d6dffc029e18f088fc85e9000193898943b81a8f1ddeb3
Opcode Fuzzy Hash: 71a82b9465efe88467356a1ebfe8692d7bc248a74da184a9ce126eebc39bc19f
Instruction Fuzzy Hash: D2F2F675810F498EC30ACF7AFD9122AB375BF9A385754930AD406F6329EBB150C2DB64

Function 00CFA5B0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 00CFA5BA

Part of subcall function 00CFA481: __lock.LIBCMT ref: 00CFA48F
Part of subcall function 00CFA481: DecodePointer.KERNEL32(00D33D00,0000001C,00CFA36E,00000000,00000001,00000000,?,00CFA2BC,000000FF,?,00D00530,00000011,?,?,00D02990,0000000D), ref: 00CFA4CE
Part of subcall function 00CFA481: DecodePointer.KERNEL32(?,00CFA2BC,000000FF,?,00D00530,00000011,?,?,00D02990,0000000D), ref: 00CFA4DF
Part of subcall function 00CFA481: EncodePointer.KERNEL32(00000000,?,00CFA2BC,000000FF,?,00D00530,00000011,?,?,00D02990,0000000D), ref: 00CFA4F8
Part of subcall function 00CFA481: DecodePointer.KERNEL32(-00000004,?,00CFA2BC,000000FF,?,00D00530,00000011,?,?,00D02990,0000000D), ref: 00CFA508
Part of subcall function 00CFA481: EncodePointer.KERNEL32(00000000,?,00CFA2BC,000000FF,?,00D00530,00000011,?,?,00D02990,0000000D), ref: 00CFA50E
Part of subcall function 00CFA481: DecodePointer.KERNEL32(?,00CFA2BC,000000FF,?,00D00530,00000011,?,?,00D02990,0000000D), ref: 00CFA524
Part of subcall function 00CFA481: DecodePointer.KERNEL32(?,00CFA2BC,000000FF,?,00D00530,00000011,?,?,00D02990,0000000D), ref: 00CFA52F

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: 959a6a356e3f48c12129993a45e441f7c993ff8066cb151ccb2ff62e8487875a
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: 0EB0127198030C33D9102545FC03F657F0C4B40B54F500021FB0C1C1E1B5D3756094CB

Non-executed Functions

Function 00CFF9CE Relevance: 15.2, APIs: 10, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetLocaleInfoA.LIBCMT ref: 00CFFA20

Part of subcall function 00D0DD22: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00D0DD2E
Part of subcall function 00D0DD22: __crtGetLocaleInfoA_stat.LIBCMT ref: 00D0DD43

GetLastError.KERNEL32 ref: 00CFFA32
___crtGetLocaleInfoA.LIBCMT ref: 00CFFA52
___crtGetLocaleInfoA.LIBCMT ref: 00CFFA94
__calloc_crt.LIBCMT ref: 00CFFA67

Part of subcall function 00CFFC83: __calloc_impl.LIBCMT ref: 00CFFC92

__calloc_crt.LIBCMT ref: 00CFFAA9
_free.LIBCMT ref: 00CFFAC1
_free.LIBCMT ref: 00CFFB01
__calloc_crt.LIBCMT ref: 00CFFB2B
_free.LIBCMT ref: 00CFFB51

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: Locale$Info$___crt__calloc_crt_free$A_statErrorLastUpdateUpdate::___calloc_impl__crt
String ID:
API String ID: 1754018987-0
Opcode ID: d0d843bb3de2ca1dfbf7641bb8b240c6786ab6600698d41c387ee0600c9f4f3d
Instruction ID: fbb2153286c0ab5bfa2c742adae9dc8698c42171ce7c4bbbbf3f261151b33a44
Opcode Fuzzy Hash: d0d843bb3de2ca1dfbf7641bb8b240c6786ab6600698d41c387ee0600c9f4f3d
Instruction Fuzzy Hash: E751807190021EABDB649F658C42BBABB79EF14710F1440AAFA4CE2141EB31DE519B72

Function 00CEC5C0 Relevance: 12.2, APIs: 8, Instructions: 169serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00CEC644
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,?,?,00000000), ref: 00CEC6C5
GetLastError.KERNEL32 ref: 00CEC6CE
_malloc.LIBCMT ref: 00CEC70F
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,?,00000000), ref: 00CEC740
__snprintf.LIBCMT ref: 00CEC7A9
_free.LIBCMT ref: 00CEC7EF
CloseServiceHandle.ADVAPI32(00000000), ref: 00CEC7FB

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenService__snprintf_free_malloc
String ID:
API String ID: 3403677689-0
Opcode ID: 308d0ba636ec28a87bb729dad702ae4228383e6787420381dffb0b5afbf25fcb
Instruction ID: 24e49af770f19d0a266297334ab211ec4ff33b7cd88c54fc78f34d19fa713249
Opcode Fuzzy Hash: 308d0ba636ec28a87bb729dad702ae4228383e6787420381dffb0b5afbf25fcb
Instruction Fuzzy Hash: 0271A171D00B48DFCB15CFA4EC91BAEB779BF89340F108219E506BB294E7715A82CB61

Function 00D1EE73 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00D1EE8A
_wcscmp.LIBCMT ref: 00D1EE9B
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00D1F139,?,00000000), ref: 00D1EEB7
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00D1F139,?,00000000), ref: 00D1EEE1

Strings

OCP, xrefs: 00D1EE95
ACP, xrefs: 00D1EE84

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: 21982cd3021242ce30ec2884153dadb455ab3ffa93a21bf5531c476bb1afced8
Instruction ID: 85d09819545c7708f5704e688e6db98f9ec4f4342054e2ec778a538104120808
Opcode Fuzzy Hash: 21982cd3021242ce30ec2884153dadb455ab3ffa93a21bf5531c476bb1afced8
Instruction Fuzzy Hash: 6C018C31205215BADB21DE64FC45FDA3799AF007A0F088425FD04DA191EB30DAC1D7F5

Function 00CE0E80 Relevance: 9.3, APIs: 6, Instructions: 286sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00CE1037

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: b28c8aa30ad495aed0d53f3475f8bbab25171ea49bb7e2f0f39e99348cdbce03
Instruction ID: 44e1b96426f0d344de881960630cf21087a66b1b22fb0eba6d79d45164e4790e
Opcode Fuzzy Hash: b28c8aa30ad495aed0d53f3475f8bbab25171ea49bb7e2f0f39e99348cdbce03
Instruction Fuzzy Hash: 4EE15675800B489FCB16CFB9E9416ADBBB1BF89340F148349E806B7369E7712985CF60

Function 00D12AF4 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00D12B2A
__isleadbyte_l.LIBCMT ref: 00D12B58
MultiByteToWideChar.KERNEL32(75A8FC30,00000009,00000004,00000002,00000000,00000000), ref: 00D12B86
MultiByteToWideChar.KERNEL32(75A8FC30,00000009,00000004,00000001,00000000,00000000), ref: 00D12BBC

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: b9ed964c579d5e5bc85dbcf9cb377fe1abef25f768d194ec75561058bc79d90d
Instruction ID: 8082675731aefa616ef7a2d811bc2f48c655621e804245d57b7a1bff3c8b959a
Opcode Fuzzy Hash: b9ed964c579d5e5bc85dbcf9cb377fe1abef25f768d194ec75561058bc79d90d
Instruction Fuzzy Hash: 0D31A231608246BFDB218F64ED45BFA7BB5FF41310F194119E45487194EB32D8A1DBB0

Function 00CE1570 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 194pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32(00000020,?,0000000C,00000000), ref: 00CE1666

Strings

D, xrefs: 00CE16F6

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: CreatePipe
String ID: D
API String ID: 2719314638-2746444292
Opcode ID: 0f135df77a14d9f61c676c7ce0f71f7eb9489df97ffe20f9006b0fffe4cbfa60
Instruction ID: 83d680976fa26279d8e5e9b51bdab46fc1accf9203e50ebc688180c163c3a3b7
Opcode Fuzzy Hash: 0f135df77a14d9f61c676c7ce0f71f7eb9489df97ffe20f9006b0fffe4cbfa60
Instruction Fuzzy Hash: 728128B5A00708EFCB14CFA5ED44BEEB7B5FB88700F108619E506A7394DB759A80CB64

Function 00D0FA4C Relevance: 19.6, APIs: 13, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00D0FA63

Part of subcall function 00CFFC83: __calloc_impl.LIBCMT ref: 00CFFC92

__calloc_crt.LIBCMT ref: 00D0FA87
_free.LIBCMT ref: 00D0FA95
__calloc_crt.LIBCMT ref: 00D0FAA3
_free.LIBCMT ref: 00D0FAB3
_free.LIBCMT ref: 00D0FAB9
__copytlocinfo_nolock.LIBCMT ref: 00D0FAC8
__wsetlocale_nolock.LIBCMT ref: 00D0FAD5
__setmbcp_nolock.LIBCMT ref: 00D0FAE9
_free.LIBCMT ref: 00D0FAF7
___removelocaleref.LIBCMT ref: 00D0FAFE
___freetlocinfo.LIBCMT ref: 00D0FB05
_free.LIBCMT ref: 00D0FB0B

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 277f0f806e5c133c7829a74d9e53ba0a2d5b195e297526135160e8975b46a4ad
Instruction ID: 82e09f8186c142a1d5a82ce540b0316402a06f684cdcaa4876fcbca4b4e4bc32
Opcode Fuzzy Hash: 277f0f806e5c133c7829a74d9e53ba0a2d5b195e297526135160e8975b46a4ad
Instruction Fuzzy Hash: 05212935204605AAE7317F64DC02F1A7BA8DF41790B34403DF58C964E1DB71980096B6

Function 00CFA194 Relevance: 18.1, APIs: 12, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00CFA19C
_free.LIBCMT ref: 00CFA1B5

Part of subcall function 00CFA688: RtlFreeHeap.NTDLL(00000000,00000000,?,00D02938,00000000,00D00F5F,00D0E22D,00000000,?,00CFFC97,?,?,00000000), ref: 00CFA69C
Part of subcall function 00CFA688: GetLastError.KERNEL32(00000000,?,00D02938,00000000,00D00F5F,00D0E22D,00000000,?,00CFFC97,?,?,00000000,?,?,?,00D02A32), ref: 00CFA6AE

_free.LIBCMT ref: 00CFA1C8
_free.LIBCMT ref: 00CFA1E6
_free.LIBCMT ref: 00CFA1F8
_free.LIBCMT ref: 00CFA209
_free.LIBCMT ref: 00CFA214
_free.LIBCMT ref: 00CFA238
EncodePointer.KERNEL32(00A32918), ref: 00CFA23F
_free.LIBCMT ref: 00CFA254
_free.LIBCMT ref: 00CFA26A
_free.LIBCMT ref: 00CFA292

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: 6e39c8841e8f6f8f7c374e0f2bd4ef5ba1124abd1bdc4e3a20f523b8f0965308
Instruction ID: 66a6755681ec29ece17bb632e545c3e07ab46ccb04828b6aa134693429a7711a
Opcode Fuzzy Hash: 6e39c8841e8f6f8f7c374e0f2bd4ef5ba1124abd1bdc4e3a20f523b8f0965308
Instruction Fuzzy Hash: A6218DF2906B988FCA795F24FC40529F7B8AF0536171A412AFA0CD3360CB316841DBA7

Function 00D0FB23 Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00D0FBAD
__lock.LIBCMT ref: 00D0FBC3
__copytlocinfo_nolock.LIBCMT ref: 00D0FBD4
__wsetlocale_nolock.LIBCMT ref: 00D0FBEB
_wcscmp.LIBCMT ref: 00D0FC0E
__lock.LIBCMT ref: 00D0FC25
__updatetlocinfoEx_nolock.LIBCMT ref: 00D0FC37
___removelocaleref.LIBCMT ref: 00D0FC3D
__updatetlocinfoEx_nolock.LIBCMT ref: 00D0FC5C

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock_wcscmp
String ID:
API String ID: 1077091919-0
Opcode ID: 53947f5c0441b692ac7ffd63da8c3ab915add5160fae6817071313f745d7aef2
Instruction ID: 9742885563a90fc0fa6d8dc4677c6302d3b1b85b12fb2d4416fdf4834ae28d2c
Opcode Fuzzy Hash: 53947f5c0441b692ac7ffd63da8c3ab915add5160fae6817071313f745d7aef2
Instruction Fuzzy Hash: 7241D332904309AFDB20AFA4ED83B9D7BA0EF44314F24843DF91C966C2DB7596429B75

Function 00CF9385 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00CF9398

Part of subcall function 00CFF19F: std::exception::_Copy_str.LIBCMT ref: 00CFF1B8

__CxxThrowException@8.LIBCMT ref: 00CF93AD

Part of subcall function 00CFF37C: RaiseException.KERNEL32(?,?,?,00D33AD0,?,?,?,?,?,00CF952D,?,00D33AD0,00000000,00000001), ref: 00CFF3D1

std::exception::exception.LIBCMT ref: 00CF93C6
__CxxThrowException@8.LIBCMT ref: 00CF93DB
std::regex_error::regex_error.LIBCPMT ref: 00CF93ED

Part of subcall function 00CF905C: std::exception::exception.LIBCMT ref: 00CF9076

__CxxThrowException@8.LIBCMT ref: 00CF93FB
std::exception::exception.LIBCMT ref: 00CF9414
__CxxThrowException@8.LIBCMT ref: 00CF9429

Strings

bad function call, xrefs: 00CF942F

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: 313b02abcc9aa226719c0fafd127438805617e66656f192bf69d526307f008b2
Instruction ID: 8ad59752f20f92f79d040abb4af70d173d906ffad5c8a2681f9c21d236d4bf44
Opcode Fuzzy Hash: 313b02abcc9aa226719c0fafd127438805617e66656f192bf69d526307f008b2
Instruction Fuzzy Hash: F711B975C0020CBB8F04EFA4D8868DDBBBCEE18344F508466BE14A7251EB74A74D8BA1

Function 00CD8040 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 308sleepfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CE5BB0: _memset.LIBCMT ref: 00CE5C01
Part of subcall function 00CE5BB0: _free.LIBCMT ref: 00CE5C43

GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 00CD839B
__snprintf.LIBCMT ref: 00CD83FE
_memset.LIBCMT ref: 00CD8505
_memset.LIBCMT ref: 00CD851B
Sleep.KERNEL32(00015F90), ref: 00CD8528
DeleteFileA.KERNEL32(?), ref: 00CD8535
_memset.LIBCMT ref: 00CD8549

Strings

rj3., xrefs: 00CD844B

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: _memset$File$DeleteModuleNameSleep__snprintf_free
String ID: rj3.
API String ID: 3733618472-2374996226
Opcode ID: aa897b4a18b0c0a68586c5a37fc82b59e6a9d815c173d97faa2f1fad33fa6f9b
Instruction ID: 88a69f7e6c8bef8a12d89eebe36e04a5b6cda36c0a9e1d5738e6e36c4b9e74b4
Opcode Fuzzy Hash: aa897b4a18b0c0a68586c5a37fc82b59e6a9d815c173d97faa2f1fad33fa6f9b
Instruction Fuzzy Hash: 23D1CE71800B089FC705DBB9FC81AAEB7B5BF99300F048659E505F73A9EB716588CB61

Function 00CE16AA Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 81processfileCOMMON

Download Yara Rule

APIs

SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 00CE16CF
_memset.LIBCMT ref: 00CE16EE
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 00CE1752
WriteFile.KERNEL32(00000000,00000000,00000020,?,00000000), ref: 00CE178D
CloseHandle.KERNEL32(00000000), ref: 00CE181F
CloseHandle.KERNEL32(00CE56E4), ref: 00CE1829
CloseHandle.KERNEL32(00000020), ref: 00CE1833
CloseHandle.KERNEL32(?), ref: 00CE1843

Strings

D, xrefs: 00CE16F6

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: Handle$Close$CreateFileInformationProcessWrite_memset
String ID: D
API String ID: 3900862288-2746444292
Opcode ID: c9200214b243bfbb73481cbb0ef223187bf667ebd355adac1ec76610a3ef0f0c
Instruction ID: a44c8b5409608c474cfdc3b73b3a5d6a9f78b69b2907db8e12c34d677291286d
Opcode Fuzzy Hash: c9200214b243bfbb73481cbb0ef223187bf667ebd355adac1ec76610a3ef0f0c
Instruction Fuzzy Hash: D631E3B5E00708EFDB14CFA5E985BADBBB5FF88700F108519E605AA294D7749A80CB60

Function 00CD8E40 Relevance: 12.3, APIs: 8, Instructions: 271fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CD8EF2
ReadFile.KERNEL32(000000FF,?,?,?,00000000), ref: 00CD8F17
CloseHandle.KERNEL32(000000FF), ref: 00CD8F35
GetTickCount.KERNEL32 ref: 00CD8F4C

Part of subcall function 00CF8900: _malloc.LIBCMT ref: 00CF897B

_sprintf.LIBCMT ref: 00CD9145
CreateFileA.KERNEL32(00000001,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00CD916E
WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 00CD91DC
CloseHandle.KERNEL32(000000FF), ref: 00CD91E6

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWrite_malloc_sprintf
String ID:
API String ID: 3359727986-0
Opcode ID: e811778e3dec71761bed17687a115d474df51661b7c4763e8f5020783e4057c6
Instruction ID: 2968ffd61abdfec13247b5164cb9ec4c358f29f9932b7d0f0e282496cbe90f1e
Opcode Fuzzy Hash: e811778e3dec71761bed17687a115d474df51661b7c4763e8f5020783e4057c6
Instruction Fuzzy Hash: 08C16C75D00B4CAFCB05CFA8E851AAEBBB6FF89300F148249E905B7355D771A985CB60

Function 00CE6E60 Relevance: 12.2, APIs: 8, Instructions: 212processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00CE6EEE
Process32First.KERNEL32(00000000,00000128), ref: 00CE6F71
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00CE70A5
TerminateProcess.KERNEL32(00000000,000000FF), ref: 00CE70F8
CloseHandle.KERNEL32(00000000), ref: 00CE7102
Process32Next.KERNEL32(00000000,00000128), ref: 00CE711D
CloseHandle.KERNEL32(00000000), ref: 00CE712F
_memset.LIBCMT ref: 00CE7143

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32_memset
String ID:
API String ID: 3095088415-0
Opcode ID: a0fe04662a0b749d366204a248ae9d3fe44e66f4bb3dc965a3f4a0a4e014625a
Instruction ID: 76637da5a573b75afb6b143e2d315e14dace01effe49fbe67faf0cb9c09ab773
Opcode Fuzzy Hash: a0fe04662a0b749d366204a248ae9d3fe44e66f4bb3dc965a3f4a0a4e014625a
Instruction Fuzzy Hash: 36B17871800B488FC706CFB8E8916AEFB75FF9A380F10834AD402B6369EB715585CB60

Function 00CE6030 Relevance: 12.2, APIs: 8, Instructions: 183processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00CE6094
Process32First.KERNEL32(00000000,00000128), ref: 00CE6155
__snprintf.LIBCMT ref: 00CE620C
CreateToolhelp32Snapshot.KERNEL32(00000008,?,00000000), ref: 00CE623A
Module32First.KERNEL32(0000000D,00000224), ref: 00CE62A8
CloseHandle.KERNEL32(0000000D,0000000A,?,00CDD9E3), ref: 00CE6311
Process32Next.KERNEL32(00000000,00000128), ref: 00CE632C

Part of subcall function 00CF8900: _malloc.LIBCMT ref: 00CF897B

Part of subcall function 00CE5BB0: _memset.LIBCMT ref: 00CE5C01
Part of subcall function 00CE5BB0: _free.LIBCMT ref: 00CE5C43

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32$CloseHandleModule32Next__snprintf_free_malloc_memset
String ID:
API String ID: 2771089087-0
Opcode ID: b9cd8e2cb509c45ccd74a51f49baddf63d8abf0ee6926bf3c05419f2f71ac73d
Instruction ID: eb2ae5db0e7569bb55a8287f90939428b134341ddbd1d2cb6e871cbec59baab4
Opcode Fuzzy Hash: b9cd8e2cb509c45ccd74a51f49baddf63d8abf0ee6926bf3c05419f2f71ac73d
Instruction Fuzzy Hash: 8E819D71900B089FC715DFB5EC91AADB775FF48740F008259E509EA369EBB05681CFA0

Function 00CE7C00 Relevance: 12.1, APIs: 8, Instructions: 84registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(00A318C8,Function_00015800), ref: 00CE7C94
SetServiceStatus.ADVAPI32(00000000,00D37070), ref: 00CE7CC2
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00CE7CD0
SetServiceStatus.ADVAPI32(00000000,00D37070), ref: 00CE7D1E
WaitForSingleObject.KERNEL32(00000000,00001388), ref: 00CE7D2F
SetServiceStatus.ADVAPI32(00000000,00D37070), ref: 00CE7D61
CloseHandle.KERNEL32(00000000), ref: 00CE7D6D
SetServiceStatus.ADVAPI32(00000000,00D37070), ref: 00CE7DBB

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID:
API String ID: 3399922960-0
Opcode ID: 6f85a03a1066c1b380e23caed8fb5a002968e4a1d690adf2092350c1e71098f4
Instruction ID: 496b472b52fd41bc0f4dab9d125dba16af3dfc73e78501a015f01294ec84369b
Opcode Fuzzy Hash: 6f85a03a1066c1b380e23caed8fb5a002968e4a1d690adf2092350c1e71098f4
Instruction Fuzzy Hash: D04102F2608F84AFD329CF34FDA9B0677B9AB49740F408209E512D63A0D7B69485DB70

Function 00CDDE80 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 278COMMON

Download Yara Rule

Strings

#, xrefs: 00CDE2A3

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 9cc9b06dd419dfb1ce0261df9df857f56b39530e478744a2f250c1a2deb41084
Instruction ID: c952437a3b875c140d584e921103244671c57604e92401677c51f34c83ac55a4
Opcode Fuzzy Hash: 9cc9b06dd419dfb1ce0261df9df857f56b39530e478744a2f250c1a2deb41084
Instruction Fuzzy Hash: 91C1D170D00B49DFCB04DF68E9816BDB7B2BF85344F10825AE506EB365D7719A80EB60

Function 00D0AF7C Relevance: 10.6, APIs: 7, Instructions: 84COMMON

Download Yara Rule

APIs

___unDName.LIBCMT ref: 00D0AFAB
_strlen.LIBCMT ref: 00D0AFBE
__lock.LIBCMT ref: 00D0AFDA
_malloc.LIBCMT ref: 00D0AFEC
_malloc.LIBCMT ref: 00D0AFFD
_free.LIBCMT ref: 00D0B046

Part of subcall function 00D0047D: IsProcessorFeaturePresent.KERNEL32(00000017,00D00451,00000000,?,?,?,?,?,00D0045E,00000000,00000000,00000000,00000000,00000000,00D0C360), ref: 00D0047F

_free.LIBCMT ref: 00D0B03F

Part of subcall function 00CFA688: RtlFreeHeap.NTDLL(00000000,00000000,?,00D02938,00000000,00D00F5F,00D0E22D,00000000,?,00CFFC97,?,?,00000000), ref: 00CFA69C
Part of subcall function 00CFA688: GetLastError.KERNEL32(00000000,?,00D02938,00000000,00D00F5F,00D0E22D,00000000,?,00CFFC97,?,?,00000000,?,?,?,00D02A32), ref: 00CFA6AE

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: _free_malloc$ErrorFeatureFreeHeapLastNamePresentProcessor___un__lock_strlen
String ID:
API String ID: 3704956918-0
Opcode ID: dbc8caba7447460ed8281dbd20cd67539c86f29ac091e95e6e1dd94fb8522e52
Instruction ID: 4d8736bd4d6fba31cb69cf027682bc17d8be100aaaa8abe9c68ab1e14c8bc405
Opcode Fuzzy Hash: dbc8caba7447460ed8281dbd20cd67539c86f29ac091e95e6e1dd94fb8522e52
Instruction Fuzzy Hash: 7A21C7F1904706AAD764AB649C46B2BB7A8AF15350F148129B51CDB2C2DB74E841C6B2

Function 00D029FA Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00D029FA

Part of subcall function 00CFA3DF: EncodePointer.KERNEL32(00000000,?,00D029FF,00CFEF28,00D33DE8,00000014), ref: 00CFA3E2
Part of subcall function 00CFA3DF: __initp_misc_winsig.LIBCMT ref: 00CFA3FD
Part of subcall function 00CFA3DF: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00D009A3
Part of subcall function 00CFA3DF: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00D009B7
Part of subcall function 00CFA3DF: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00D009CA
Part of subcall function 00CFA3DF: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00D009DD
Part of subcall function 00CFA3DF: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00D009F0
Part of subcall function 00CFA3DF: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00D00A03
Part of subcall function 00CFA3DF: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00D00A16
Part of subcall function 00CFA3DF: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00D00A29
Part of subcall function 00CFA3DF: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00D00A3C
Part of subcall function 00CFA3DF: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00D00A4F
Part of subcall function 00CFA3DF: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00D00A62
Part of subcall function 00CFA3DF: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00D00A75
Part of subcall function 00CFA3DF: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00D00A88
Part of subcall function 00CFA3DF: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00D00A9B
Part of subcall function 00CFA3DF: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00D00AAE
Part of subcall function 00CFA3DF: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00D00AC1

__mtinitlocks.LIBCMT ref: 00D029FF
__mtterm.LIBCMT ref: 00D02A08
__calloc_crt.LIBCMT ref: 00D02A2D
__initptd.LIBCMT ref: 00D02A4F
GetCurrentThreadId.KERNEL32 ref: 00D02A56

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: AddressProc$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm
String ID:
API String ID: 1593083391-0
Opcode ID: 2b0c0f93c4613332a7e9bce1395cc2a569f57c6386fa33190310ccd65d0abb9b
Instruction ID: bc583ec05d6fbd78a31188d172c01880372359b8c48d3def0391c1121cc78760
Opcode Fuzzy Hash: 2b0c0f93c4613332a7e9bce1395cc2a569f57c6386fa33190310ccd65d0abb9b
Instruction Fuzzy Hash: 2EF0243221A7512DE63877743C0B77A2A84DF01738F24062EF46CE50E1FF11894281B4

Function 00CE5000 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 439COMMON

Download Yara Rule

Strings

, xrefs: 00CE5674
, xrefs: 00CE5322

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: _free_memset
String ID: $
API String ID: 287624719-227171996
Opcode ID: 5df450d20ff87472c863c57d206a9cf9574b2d5c90f719d52c500a7d397845e0
Instruction ID: 85f3dea6e0f9c0e5872abf83cc27ae9d6d7976235c6ef668825e5974d373f0bb
Opcode Fuzzy Hash: 5df450d20ff87472c863c57d206a9cf9574b2d5c90f719d52c500a7d397845e0
Instruction Fuzzy Hash: D6129E75C00B489FCB05CFA9EC81AAEB7B1BF89344F148219E509BB365E7716585CFA0

Function 00D0F363 Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00D0F8FF

Part of subcall function 00D0050D: __mtinitlocknum.LIBCMT ref: 00D0051F
Part of subcall function 00D0050D: __amsg_exit.LIBCMT ref: 00D0052B
Part of subcall function 00D0050D: EnterCriticalSection.KERNEL32(?,?,00D02990,0000000D), ref: 00D00538

_free.LIBCMT ref: 00D0F925

Part of subcall function 00CFA688: RtlFreeHeap.NTDLL(00000000,00000000,?,00D02938,00000000,00D00F5F,00D0E22D,00000000,?,00CFFC97,?,?,00000000), ref: 00CFA69C
Part of subcall function 00CFA688: GetLastError.KERNEL32(00000000,?,00D02938,00000000,00D00F5F,00D0E22D,00000000,?,00CFFC97,?,?,00000000,?,?,?,00D02A32), ref: 00CFA6AE

__lock.LIBCMT ref: 00D0F93E
___removelocaleref.LIBCMT ref: 00D0F94D
___freetlocinfo.LIBCMT ref: 00D0F966
_free.LIBCMT ref: 00D0F979

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: 5154600c459656be1a9be8071274736a620176d12357c19cce9ece14a1015c67
Instruction ID: 0d3b88a9e7f555e8b2def85277b3d117d2c6f07be59b4d2705e8d3741f830683
Opcode Fuzzy Hash: 5154600c459656be1a9be8071274736a620176d12357c19cce9ece14a1015c67
Instruction Fuzzy Hash: A101D231901304BADB346F68E80672DB7A0DF00721F78463DF4ACA69D1CB749981DEB6

Function 00CD94B0 Relevance: 7.7, APIs: 5, Instructions: 197synchronizationCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,00D37440,00000104), ref: 00CD9599
_memset.LIBCMT ref: 00CD966E
GetTickCount.KERNEL32 ref: 00CD96A4
__vfwprintf_p.LIBCMT ref: 00CD975A
ReleaseMutex.KERNEL32(00000100), ref: 00CD9790

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: CountFileModuleMutexNameReleaseTick__vfwprintf_p_memset
String ID:
API String ID: 2753155262-0
Opcode ID: c3ab2caec46720d7157c69dc4a24f05cf75103475589b168c29f84b1bdc9540b
Instruction ID: 8bd5281f7c546b849b600b1526256a7b37e38ddb8d3e09ad7f08ee081035c5f0
Opcode Fuzzy Hash: c3ab2caec46720d7157c69dc4a24f05cf75103475589b168c29f84b1bdc9540b
Instruction Fuzzy Hash: A2819FB5D00B08AFCB05CFB9EC82AADBBB1EF49300F048259E905B7365E7716584CB61

Function 00CE9EE0 Relevance: 7.7, APIs: 5, Instructions: 196processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00CEA00D
Process32First.KERNEL32(00000000,00000128), ref: 00CEA04D
Process32Next.KERNEL32(00000000,00000128), ref: 00CEA206
CloseHandle.KERNEL32(00000000), ref: 00CEA218
_memset.LIBCMT ref: 00CEA261

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memset
String ID:
API String ID: 2526126748-0
Opcode ID: 65df0c2d0f6a714d88afcf002cc24dc542a237a0754099cb2003501d3a5e05b7
Instruction ID: fca39dce9aa9937137da801c075269f7cbf55a322207981f162534941737fe33
Opcode Fuzzy Hash: 65df0c2d0f6a714d88afcf002cc24dc542a237a0754099cb2003501d3a5e05b7
Instruction Fuzzy Hash: DDA19775800B49CECB09CFA5E8806AEBBB1FF59344F048249D415B6328E77626C5CFA5

Function 00CEA690 Relevance: 7.6, APIs: 5, Instructions: 120fileCOMMON

Download Yara Rule

APIs

std::ios_base::good.LIBCPMTD ref: 00CEA74F
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00CEA7A2
std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 00CEA7B1
DeleteFileA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00CD7A5E), ref: 00CEA7BE
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00CEA828

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: Affinity::operator!=Concurrency::details::Hardware$DeleteFileMutex_baseMutex_base::~_std::_std::ios_base::good
String ID:
API String ID: 1152012751-0
Opcode ID: 6aba555c47f53b9db9cc96f57e6c9bf2277e6ec847e59634a0ee81847b3f0400
Instruction ID: ce4edf18cd0c1aff4be5ea7006538057cbff1dbd2a106521941690b2b02ae6f4
Opcode Fuzzy Hash: 6aba555c47f53b9db9cc96f57e6c9bf2277e6ec847e59634a0ee81847b3f0400
Instruction Fuzzy Hash: 3551CF71810B48DEC70AEBB2FC915AEB374FF58340714865AE502B7265FB302A85EB60

Function 00D23B77 Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00D23BB2
_strlen.LIBCMT ref: 00D23BC0

Part of subcall function 00D00F5A: __getptd_noexit.LIBCMT ref: 00D00F5A

_strnlen.LIBCMT ref: 00D23C4B
__lock.LIBCMT ref: 00D23C5C
__getenv_helper_nolock.LIBCMT ref: 00D23C67

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: 61ab4ab30a78c385cd78541b89be0ee9ad9cb1aa884ca8582ad23621bdf996a4
Instruction ID: 65cbf91c52628852926a8b6ee886629c4f224390e98a3d02483b9873418516df
Opcode Fuzzy Hash: 61ab4ab30a78c385cd78541b89be0ee9ad9cb1aa884ca8582ad23621bdf996a4
Instruction Fuzzy Hash: B131C832A042366BDB216E64EC02B6E6A64EF25B25F140125F908EB2C1DA7DCA0157F1

Function 00D0E0FD Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00D0E109

Part of subcall function 00CFA6FD: __FF_MSGBANNER.LIBCMT ref: 00CFA714
Part of subcall function 00CFA6FD: __NMSG_WRITE.LIBCMT ref: 00CFA71B
Part of subcall function 00CFA6FD: RtlAllocateHeap.NTDLL(00A20000,00000000,00000001,00000000,00000000,00000000,?,00CFFCE1,00000000,00000000,00000000,00000000,?,00D005F7,00000018,00D33E08), ref: 00CFA740

_free.LIBCMT ref: 00D0E11C

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 38e7bdba7d4a879ed5b6b45232fc4bca1e80265434d87ced6bec79cced2fae4d
Instruction ID: 75379d08754bd228429767cffafe4422cee6ffb9831e2354e8efebe55c01081a
Opcode Fuzzy Hash: 38e7bdba7d4a879ed5b6b45232fc4bca1e80265434d87ced6bec79cced2fae4d
Instruction Fuzzy Hash: 5911063250832AAACB312F74EC047693FA8DF14361F184D29FA9CD62D0DA34C851A6B3

Function 00CD9D40 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00CD9DBA
CreateThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00CD9DD5
CloseHandle.KERNEL32(?), ref: 00CD9DE2
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00CD9DF0
CloseHandle.KERNEL32(00000000,?,000000FF), ref: 00CD9DFC

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: 0ae770523a71b0d718e94aed77b83d201fd4a2118319bcfc00faa5c6f5969f5c
Instruction ID: 5a99c82defffe3b6a31064676128c38e7f789fdd5f684bc905334b6b3c1ef7f8
Opcode Fuzzy Hash: 0ae770523a71b0d718e94aed77b83d201fd4a2118319bcfc00faa5c6f5969f5c
Instruction Fuzzy Hash: D7211534A00708EFC705CFA5ED85B59BBB5FB49740F208645E806EB3A4D770A984DF60

Function 00CD7390 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 410COMMON

Download Yara Rule

Strings

C:\bamqdjw\czmruiag.exe, xrefs: 00CD7ABE
Z, xrefs: 00CD76E2

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: CountSystemTickTime_malloc
String ID: C:\bamqdjw\czmruiag.exe$Z
API String ID: 3770554779-795484970
Opcode ID: fc004d966d431487a9dcb2488bf18b7039baf19c8acc5efe01f7380251ad979e
Instruction ID: 9c03a14df3120742da848a5d93d4ddd226c5ed5fcf12996de0df7f1b36496782
Opcode Fuzzy Hash: fc004d966d431487a9dcb2488bf18b7039baf19c8acc5efe01f7380251ad979e
Instruction Fuzzy Hash: 39127D75C00B089ECB06DFB4EC916AEB375BF99340F14825AE50AB7365EB705685CB60

Function 00CDD7B0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 307COMMON

Download Yara Rule

APIs

__snprintf.LIBCMT ref: 00CDD8D3
_memset.LIBCMT ref: 00CDD906
_memset.LIBCMT ref: 00CDDD04

Strings

C:\Users\user, xrefs: 00CDD90E

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: _memset$__snprintf
String ID: C:\Users\user
API String ID: 1922369481-2179397983
Opcode ID: 0b7038ae1945af4cf8d4b32797a414230a0b15556c46c4afe8b413fe7559b020
Instruction ID: 5def6c68fb6cd6e716a08840deecfaa5afc107d76ffdaaa25c4bb94fa52c2846
Opcode Fuzzy Hash: 0b7038ae1945af4cf8d4b32797a414230a0b15556c46c4afe8b413fe7559b020
Instruction Fuzzy Hash: 6AD19E71810F089AC706EFB5FC92AADB334FF55740F04821AE106B6266FBB16585DB61

Function 00CD76A3 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 279sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000008AE), ref: 00CD7A4D

Part of subcall function 00CF8900: _malloc.LIBCMT ref: 00CF897B

Part of subcall function 00CE5BB0: _memset.LIBCMT ref: 00CE5C01
Part of subcall function 00CE5BB0: _free.LIBCMT ref: 00CE5C43

_memset.LIBCMT ref: 00CD79B3

Strings

C:\bamqdjw\czmruiag.exe, xrefs: 00CD7ABE
Z, xrefs: 00CD76E2

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: _memset$Sleep_free_malloc
String ID: C:\bamqdjw\czmruiag.exe$Z
API String ID: 3151160524-795484970
Opcode ID: 3fa1034d89aa6826b062582fb61d884b158f2bbfff5597c5ced210204042db12
Instruction ID: ff90fcc37bdb030e5270c999e8ede7a7e39be9f3758dbfc62bac798626c0334b
Opcode Fuzzy Hash: 3fa1034d89aa6826b062582fb61d884b158f2bbfff5597c5ced210204042db12
Instruction Fuzzy Hash: B8C17DB5C00B089FCB15DFA4EC81AADB375BF58300F04825AE609B7365EB706A85DF61

Function 00D0F2F6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 00D0F309

Strings

U, xrefs: 00D0F312

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: e03f6fb461ab144c001b44130f79cf1af102bda91f4263ec954a5d45af065125
Instruction ID: c0cf050219ed52215f72f4a5f59dbd14dfef2cee75ad2fc706c21632abd31ac7
Opcode Fuzzy Hash: e03f6fb461ab144c001b44130f79cf1af102bda91f4263ec954a5d45af065125
Instruction Fuzzy Hash: EA21C3326042086BEB24DF64EC46BBE73ACDB45760F640175F94CCA5D0EA60ED4186B0

Function 00D1E5FE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00D1E615
_wcscmp.LIBCMT ref: 00D1E626

Strings

OCP, xrefs: 00D1E620
ACP, xrefs: 00D1E60F

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: _wcscmp
String ID: ACP$OCP
API String ID: 856254489-711371036
Opcode ID: c9632030f06dbb2fe8f6695e73d1537add1c978de1717a3924e3e459adbdbcaf
Instruction ID: 4b75aaf3672504455e4edecb3d36270792debfe63752a8e952bca893ba360086
Opcode Fuzzy Hash: c9632030f06dbb2fe8f6695e73d1537add1c978de1717a3924e3e459adbdbcaf
Instruction Fuzzy Hash: B801963130121576EB20AA58EC46FD6339CDF243A4F484C12FD08DA181EA70D6C486F9

Function 00CF5D20 Relevance: 6.3, APIs: 4, Instructions: 252COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00CF5F63
_malloc.LIBCMT ref: 00CF5FB4

Part of subcall function 00CFA6FD: __FF_MSGBANNER.LIBCMT ref: 00CFA714
Part of subcall function 00CFA6FD: __NMSG_WRITE.LIBCMT ref: 00CFA71B
Part of subcall function 00CFA6FD: RtlAllocateHeap.NTDLL(00A20000,00000000,00000001,00000000,00000000,00000000,?,00CFFCE1,00000000,00000000,00000000,00000000,?,00D005F7,00000018,00D33E08), ref: 00CFA740

_memset.LIBCMT ref: 00CF60D6
_free.LIBCMT ref: 00CF60E4

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: _malloc$AllocateHeap_free_memset
String ID:
API String ID: 3974598690-0
Opcode ID: f3d59200e04f39dbea9110f3662c7e3245cecec3a3c1dc93d8b91d557ff99f90
Instruction ID: 2e9db378d05485d48a9224256b0b202da211c75b7d6cb57d2a9e1a017b5baa1b
Opcode Fuzzy Hash: f3d59200e04f39dbea9110f3662c7e3245cecec3a3c1dc93d8b91d557ff99f90
Instruction Fuzzy Hash: D6C18875800B08DFC709CF6AF880569B7B1FF89384B14C619E909EB329E771A585CFA5

Function 00D0D34E Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00D0D3DF
_memmove.LIBCMT ref: 00D0D453
___AdjustPointer.LIBCMT ref: 00D0D4A4
_memmove.LIBCMT ref: 00D0D4AD

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: AdjustPointer_memmove
String ID:
API String ID: 1721217611-0
Opcode ID: 5335c763bfd40bf81e3e467ff547630b631a6619b535918745e5ea7e84ea0928
Instruction ID: 4b2824efa97c51b0bd7aa07fa4a9d1c944db8c80d91cee3e54bb9e3a9ef7ff99
Opcode Fuzzy Hash: 5335c763bfd40bf81e3e467ff547630b631a6619b535918745e5ea7e84ea0928
Instruction Fuzzy Hash: 4541A935204303AFEB356EA5E881B6A7BE6DF41710F28401FF9498A5D2EF71E980D631

Function 00CD3D80 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00CD3DB2

Part of subcall function 00CFA6FD: __FF_MSGBANNER.LIBCMT ref: 00CFA714
Part of subcall function 00CFA6FD: __NMSG_WRITE.LIBCMT ref: 00CFA71B
Part of subcall function 00CFA6FD: RtlAllocateHeap.NTDLL(00A20000,00000000,00000001,00000000,00000000,00000000,?,00CFFCE1,00000000,00000000,00000000,00000000,?,00D005F7,00000018,00D33E08), ref: 00CFA740

_memset.LIBCMT ref: 00CD3DDA
_memset.LIBCMT ref: 00CD3E25
_free.LIBCMT ref: 00CD3E34

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: _memset$AllocateHeap_free_malloc
String ID:
API String ID: 585861054-0
Opcode ID: 39551438238991d948e20618a79ca36c132be51084d80beba23a2f035d5dc697
Instruction ID: fc79ce2378732562c9f6bd9f07d20ae00a7f04cf9056e5c1fc90c7c5f5363dc9
Opcode Fuzzy Hash: 39551438238991d948e20618a79ca36c132be51084d80beba23a2f035d5dc697
Instruction Fuzzy Hash: D3316BB8900608AFC714CF28E881A6AB766EF88340F14C259F8099B355D731EA85DB91

Function 00D0F368 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00D028C0: __getptd_noexit.LIBCMT ref: 00D028C1
Part of subcall function 00D028C0: __amsg_exit.LIBCMT ref: 00D028CE

__calloc_crt.LIBCMT ref: 00D0F9B6

Part of subcall function 00CFFC83: __calloc_impl.LIBCMT ref: 00CFFC92

__lock.LIBCMT ref: 00D0F9EC
___addlocaleref.LIBCMT ref: 00D0F9F8
__lock.LIBCMT ref: 00D0FA0C

Part of subcall function 00D00F5A: __getptd_noexit.LIBCMT ref: 00D00F5A

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 35589aec1f1b6ce77f2f50ccef6cbac193f1102a2d71dc69c86305765837fa31
Instruction ID: 2cad9968b1abe1ac6e4f07f82ae49306f8587e3325acd614ccdd313dda0d4db8
Opcode Fuzzy Hash: 35589aec1f1b6ce77f2f50ccef6cbac193f1102a2d71dc69c86305765837fa31
Instruction Fuzzy Hash: 79015231A05305ABD770FFB89806B2D7BA0DF85720F318559F59C9B2C2CA7449419AB1

Function 00D0B304 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00D0B328

Part of subcall function 00D0BA48: __fltout2.LIBCMT ref: 00D0BA71

__cftog_l.LIBCMT ref: 00D0B34E
__cftoe_l.LIBCMT ref: 00D0B380

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 4b9b568c3a7655d8074566b9469e635456693f9627d9ba99e416095f374747cf
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 1A01407204414AFBCF125E84CC05AEE3F66FB19364B698516FA1C58071D336D9B1ABA1

Function 00D0CBB4 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 00D0CBCB

Part of subcall function 00D0D2C0: ___AdjustPointer.LIBCMT ref: 00D0D309

_UnwindNestedFrames.LIBCMT ref: 00D0CBE2
___FrameUnwindToState.LIBCMT ref: 00D0CBF4
CallCatchBlock.LIBCMT ref: 00D0CC18

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: 2d8c29e931c82cb4b179de0235233341f27f52423f207cbaa2e250d67f1f5fc6
Instruction ID: ebf211f50b7d81e43fe4e2609298ba83c23ad0d095b49972135ff781a702c45d
Opcode Fuzzy Hash: 2d8c29e931c82cb4b179de0235233341f27f52423f207cbaa2e250d67f1f5fc6
Instruction Fuzzy Hash: DD012932400109BBCF126FA5CC01FEA7BBAFF48754F149115FA1C61161D332E861EBA1

Function 00CDE1E6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00CDE2F6
_memcmp.LIBCMT ref: 00CDE314

Strings

#, xrefs: 00CDE2A3

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: _memcmp
String ID: #
API String ID: 2931989736-1885708031
Opcode ID: a46d8d43d2204f9cb750155fd74b36680d4656a6c8c5ba90e1f7a570e0d34b4f
Instruction ID: 649f00c0920e9cc006ae6000ce860c8871871d4f6af094eca6387e5ddd56cdbc
Opcode Fuzzy Hash: a46d8d43d2204f9cb750155fd74b36680d4656a6c8c5ba90e1f7a570e0d34b4f
Instruction Fuzzy Hash: E3317C71C00F09CBC706DF74FD016AAB376BF9A344F108316E606BA329E77155829BA4

Function 00CE1799 Relevance: 5.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000), ref: 00CE181F
CloseHandle.KERNEL32(00CE56E4), ref: 00CE1829
CloseHandle.KERNEL32(00000020), ref: 00CE1833
CloseHandle.KERNEL32(?), ref: 00CE1843

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 0b2bd7513d7b823561fe6310bec5897f2b41b370a0a32e9db7386fe052c2b917
Instruction ID: 0111fb24ecad6fd8eeff1121c1f212296b7da8e92194f398e788d684fdfd6c21
Opcode Fuzzy Hash: 0b2bd7513d7b823561fe6310bec5897f2b41b370a0a32e9db7386fe052c2b917
Instruction Fuzzy Hash: F4F03A75E01208EFCB24CFE2F948AAE7B75FB44301F108949E91196394CB38D950CFA0

Function 00CE1766 Relevance: 5.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000), ref: 00CE181F
CloseHandle.KERNEL32(00CE56E4), ref: 00CE1829
CloseHandle.KERNEL32(00000020), ref: 00CE1833
CloseHandle.KERNEL32(?), ref: 00CE1843

Memory Dump Source

Source File: 00000001.00000002.1705125045.0000000000CD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000001.00000002.1705092895.0000000000CD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705175064.0000000000D27000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D35000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705225202.0000000000D39000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1705279647.0000000000D3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cd0000_mt2o4nrsazl5davsv.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: fec31c4cb2e5194c8bea59f9cddf8f1d51ab0cce73c8721e1d5b2c3b2ede85d6
Instruction ID: 0111fb24ecad6fd8eeff1121c1f212296b7da8e92194f398e788d684fdfd6c21
Opcode Fuzzy Hash: fec31c4cb2e5194c8bea59f9cddf8f1d51ab0cce73c8721e1d5b2c3b2ede85d6
Instruction Fuzzy Hash: F4F03A75E01208EFCB24CFE2F948AAE7B75FB44301F108949E91196394CB38D950CFA0

Analysis Process: erewpegtq.exePID: 5772, Parent PID: 620COMMON

Execution Graph

Execution Coverage:	13%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1845
Total number of Limit Nodes:	132

Executed Functions

Function 00CAE9C0 Relevance: 272.4, APIs: 150, Strings: 3, Instructions: 4607libraryloadersleepCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00CAECF9
_memset.LIBCMT ref: 00CAED7D
GetModuleHandleA.KERNEL32(?), ref: 00CAEF7A
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAF009
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAF0CA
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAF194

Part of subcall function 00CB8900: _malloc.LIBCMT ref: 00CB897B

Part of subcall function 00CA5BB0: _memset.LIBCMT ref: 00CA5C01
Part of subcall function 00CA5BB0: _free.LIBCMT ref: 00CA5C43

GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAF2E2
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAF320
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAF35E
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAF39C
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAF3DA
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAF418
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAF47E
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAF4F9
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAF57A
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAF670
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAF6AF
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAF77F
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAF7FC
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAF853
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAF9FD
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAFA3C
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAFA7B
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAFAD8
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAFB4E
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAFBE8
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAFC27
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAFCA7
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAFCE5
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAFD53
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAFD91
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAFDCF
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAFE4A
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAFE89
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAFEC8
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAFF70
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CAFFAE
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB0013
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB0051
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB00B9
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB00F7
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB024B
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB028A
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB02D5
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB0314
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB0353
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB03BC
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB041D
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB04E0
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB054B
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB065A
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB0699
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB0790
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB07D9
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB0838
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB0877
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB08E6
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB0925
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB0964
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB09D3
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB0AE9
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB0BD4
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB0C52
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB0CD9
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB0D2B
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB0D6A
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB0E21
GetProcAddress.KERNEL32(74DD0000,?), ref: 00CB0EA6
LoadLibraryA.KERNELBASE(?), ref: 00CB0EF6
LoadLibraryA.KERNEL32(?), ref: 00CB0F92
GetProcAddress.KERNEL32(74D60000,?), ref: 00CB0FEE
GetProcAddress.KERNEL32(74D60000,?), ref: 00CB102D
GetProcAddress.KERNEL32(74D60000,?), ref: 00CB10E2
GetProcAddress.KERNEL32(74D60000,?), ref: 00CB1131
GetProcAddress.KERNEL32(74D60000,?), ref: 00CB118A
GetProcAddress.KERNEL32(74D60000,?), ref: 00CB11C9
GetProcAddress.KERNEL32(74D60000,?), ref: 00CB1208
GetProcAddress.KERNEL32(74D60000,?), ref: 00CB12B9
GetProcAddress.KERNEL32(74D60000,?), ref: 00CB12F8
GetProcAddress.KERNEL32(74D60000,?), ref: 00CB14DB
GetProcAddress.KERNEL32(74D60000,?), ref: 00CB15E0
GetProcAddress.KERNEL32(74D60000,?), ref: 00CB1634
GetProcAddress.KERNEL32(74D60000,?), ref: 00CB1673
GetProcAddress.KERNEL32(74D60000,?), ref: 00CB16B2
GetProcAddress.KERNEL32(74D60000,?), ref: 00CB1730
GetProcAddress.KERNEL32(74D60000,?), ref: 00CB176E
GetProcAddress.KERNEL32(74D60000,?), ref: 00CB17E5
LoadLibraryA.KERNELBASE(?), ref: 00CB18B9
GetProcAddress.KERNEL32(75A70000,?), ref: 00CB18F8
GetProcAddress.KERNEL32(75A70000,?), ref: 00CB1990
GetProcAddress.KERNEL32(75A70000,?), ref: 00CB19CF
GetProcAddress.KERNEL32(75A70000,?), ref: 00CB1A26
GetProcAddress.KERNEL32(75A70000,?), ref: 00CB1A89
GetProcAddress.KERNEL32(75A70000,?), ref: 00CB1AD8
GetProcAddress.KERNEL32(75A70000,?), ref: 00CB1B3B
GetProcAddress.KERNEL32(75A70000,?), ref: 00CB1BAA
GetProcAddress.KERNEL32(75A70000,?), ref: 00CB1C18
GetProcAddress.KERNEL32(75A70000,?), ref: 00CB1D36
GetProcAddress.KERNEL32(75A70000,?), ref: 00CB1D75
GetProcAddress.KERNEL32(75A70000,?), ref: 00CB1DB4
GetProcAddress.KERNEL32(75A70000,?), ref: 00CB1DF3
GetProcAddress.KERNEL32(75A70000,?), ref: 00CB1E32
GetProcAddress.KERNEL32(75A70000,?), ref: 00CB1E89
GetProcAddress.KERNEL32(75A70000,?), ref: 00CB1EF0
GetProcAddress.KERNEL32(75A70000,?), ref: 00CB1FA7
GetProcAddress.KERNEL32(75A70000,?), ref: 00CB201D
GetProcAddress.KERNEL32(75A70000,?), ref: 00CB205B
GetProcAddress.KERNEL32(75A70000,?), ref: 00CB2118
GetProcAddress.KERNEL32(75A70000,?), ref: 00CB2175
GetProcAddress.KERNEL32(75A70000,?), ref: 00CB21B4
GetProcAddress.KERNEL32(75A70000,?), ref: 00CB21F3
GetProcAddress.KERNEL32(75A70000,?), ref: 00CB2232
GetProcAddress.KERNEL32(75A70000,?), ref: 00CB2299

Part of subcall function 00C97DE0: GetSystemTime.KERNEL32(?,?,?,?,?,?,00C974FC), ref: 00C97E5C
Part of subcall function 00C97DE0: GetTickCount.KERNEL32 ref: 00C97EEF

GetEnvironmentVariableA.KERNEL32(?,C:\Windows\system32\config\systemprofile,00000104), ref: 00CB233E
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00CB2391
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00CB23AC
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00CB23BD

Part of subcall function 00CB94DD: _malloc.LIBCMT ref: 00CB94F5

GetTickCount.KERNEL32 ref: 00CB2543
__itow.LIBCMT ref: 00CB254A

Part of subcall function 00CAACD0: GetVersionExA.KERNEL32(00CF6DB8), ref: 00CAAD42
Part of subcall function 00CAACD0: CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00CAAE1E

__stat32i64.LIBCMT ref: 00CB2A37

Part of subcall function 00CBA7E0: ___copy_path_to_wide_string.LIBCMT ref: 00CBA7F5

Sleep.KERNEL32(00000D05), ref: 00CB2A7E
__stat32i64.LIBCMT ref: 00CB2A92

Part of subcall function 00CBA7E0: __wstat64i32.LIBCMT ref: 00CBA80D
Part of subcall function 00CBA7E0: _free.LIBCMT ref: 00CBA817

Sleep.KERNEL32(000007D0), ref: 00CB2C44
__stat32i64.LIBCMT ref: 00CB2C57
GetModuleFileNameA.KERNEL32(00000000,?,00000200), ref: 00CB2C8C
SetFileAttributesA.KERNEL32(00000000,00000080), ref: 00CB2C9B
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00CB2CE0
SetFileAttributesA.KERNEL32(00000000,00000002), ref: 00CB2F2B
SetFileAttributesA.KERNEL32(00000000,00000080), ref: 00CB2F3C
Sleep.KERNEL32(000003E8), ref: 00CB302E
GetCommandLineA.KERNEL32 ref: 00CB3071
GetModuleFileNameA.KERNEL32(00000000,00000000,00000200), ref: 00CB313E
LoadLibraryA.KERNEL32(?), ref: 00CB3379
GetProcAddress.KERNEL32(?,?), ref: 00CB33B9
WSAStartup.WS2_32(00000202,?), ref: 00CB3912

Part of subcall function 00CA1CE0: _strstr.LIBCMT ref: 00CA1CEB

CloseHandle.KERNEL32(0000011C), ref: 00CB3AA1
SetFileAttributesA.KERNEL32(?,00000080), ref: 00CB3AB3
CopyFileA.KERNEL32(00000000,?,00000000), ref: 00CB3AC9
SetFileAttributesA.KERNEL32(?,00000002), ref: 00CB3AE0
Sleep.KERNEL32(000003E8), ref: 00CB3B3C

Part of subcall function 00CA4900: _memset.LIBCMT ref: 00CA4A25

Sleep.KERNEL32(000007D0), ref: 00CB3BD1

Part of subcall function 00CBAE47: __fsopen.LIBCMT ref: 00CBAE52

Part of subcall function 00C92240: Sleep.KERNEL32(000003E8,?,?,?,?,?,?,00C9763B,?), ref: 00C922FA

SetFileAttributesA.KERNELBASE(C:\bamqdjw\czmruiag.exe,00000080), ref: 00CB3BE3
CopyFileA.KERNEL32(00000000,C:\bamqdjw\czmruiag.exe,00000000), ref: 00CB3BF7
SetFileAttributesA.KERNELBASE(C:\bamqdjw\czmruiag.exe,00000002), ref: 00CB3C44

Part of subcall function 00CA6E60: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00CA6EEE
Part of subcall function 00CA6E60: Process32First.KERNEL32(00000000,00000128), ref: 00CA6F71

__snprintf.LIBCMT ref: 00CB3E23
_memset.LIBCMT ref: 00CB3EF4
_memset.LIBCMT ref: 00CB3F0A
CreateThread.KERNELBASE(00000000,00000000,Function_00007390,00000000,00000000,00000000), ref: 00CB3F21
Sleep.KERNEL32(0000C350), ref: 00CB3F63
GetCommandLineA.KERNEL32 ref: 00CB263F

Part of subcall function 00CBA5B0: _doexit.LIBCMT ref: 00CBA5BA

Strings

C:\bamqdjw\czmruiag.exe, xrefs: 00CB3799, 00CB3819, 00CB3BDE, 00CB3BEB, 00CB3C3F, 00CB3ED9
C:\Windows\system32\config\systemprofile, xrefs: 00CB2332
ulazkbbwltmi "c:\bamqdjw\erewpegtq.exe", xrefs: 00CB3E1E, 00CB3ED4

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: AddressProc$File$AttributesSleep$Create$_memset$LibraryLoad$CopyModuleMutex__stat32i64_malloc$CommandCountHandleLineNameTick_free$CloseDirectoryEnvironmentFirstProcess32SnapshotStartupSystemThreadTimeToolhelp32VariableVersion___copy_path_to_wide_string__fsopen__itow__snprintf__wstat64i32_doexit_strstr
String ID: C:\Windows\system32\config\systemprofile$C:\bamqdjw\czmruiag.exe$ulazkbbwltmi "c:\bamqdjw\erewpegtq.exe"
API String ID: 3228906957-2524360930
Opcode ID: 55f144d32b2cef55aef166e04bae6e80a391d327fa4a4ae0b0a950ac1bae0782
Instruction ID: fb3718246b67eec23c488149b0a91d82bd84f83c7573ab558aba6b8933082765
Opcode Fuzzy Hash: 55f144d32b2cef55aef166e04bae6e80a391d327fa4a4ae0b0a950ac1bae0782
Instruction Fuzzy Hash: 83A39DB1D00A489FD712CF74EC91BBDBB75BF49345F008259E709AA261EB712984CF52

Function 00C9E7A0 Relevance: 25.0, APIs: 13, Strings: 1, Instructions: 510
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CB8900: _malloc.LIBCMT ref: 00CB897B

GetProcessHeap.KERNEL32 ref: 00C9E86C
LoadLibraryA.KERNELBASE(?), ref: 00C9E8C8

Part of subcall function 00CA5BB0: _memset.LIBCMT ref: 00CA5C01
Part of subcall function 00CA5BB0: _free.LIBCMT ref: 00CA5C43

GetProcAddress.KERNEL32(00000000,?), ref: 00C9E9D5
FreeLibrary.KERNEL32(00000000), ref: 00C9E9F6
HeapAlloc.KERNEL32(00000000,00000000,00000288), ref: 00C9EA2D
FreeLibrary.KERNEL32(00000000), ref: 00C9EA40
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 00C9EA55
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00C9EA7B
HeapAlloc.KERNEL32(00000000,00000000,00000288), ref: 00C9EA8B
FreeLibrary.KERNEL32(00000000), ref: 00C9EA9E

Strings

o, xrefs: 00C9EA5B

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: FreeHeapLibrary$Alloc$AdaptersAddressInfoLoadProcProcess_free_malloc_memset
String ID: o
API String ID: 1543936905-252678980
Opcode ID: 92a00d3db66118d046daaafa3ee06f63cf80a525430e457dac745831fc5b6abe
Instruction ID: 8d9f2d88b4a069d2c9be9c4c879788b8791f2a0bc499cb2b0aa7771c98e778d6
Opcode Fuzzy Hash: 92a00d3db66118d046daaafa3ee06f63cf80a525430e457dac745831fc5b6abe
Instruction Fuzzy Hash: 3E425871D00A48DFCB06CFB9E894BADBBB1BF59304F148259E605BB261E7306985CF52

Function 00CA67C0 Relevance: 12.2, APIs: 8, Instructions: 201
libraryencryptionloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75A70000,?), ref: 00CA6898
GetProcAddress.KERNEL32(75A70000,?), ref: 00CA68CD
CryptAcquireContextA.ADVAPI32(00CF75B0,00000000,00000000,00000001,00000000,?,?,?,?,?,?,?,?,?), ref: 00CA692D
CryptGenRandom.ADVAPI32(00000000,00000004,00C922A8,?,?,?,?,?,?,?,?,?,?,?,?,00C922A8), ref: 00CA69A8
_rand.LIBCMT ref: 00CA69C9
_rand.LIBCMT ref: 00CA69D1
_rand.LIBCMT ref: 00CA6A2E
_rand.LIBCMT ref: 00CA6A36

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: _rand$AddressCryptProc$AcquireContextRandom
String ID:
API String ID: 3501257216-0
Opcode ID: 13827038857effc63ef82136b442e555c97f8c0695d67c90c2aa9cf4ab0f3b8c
Instruction ID: abc29b79d25f5b0ed2b313f7afe9d3f52d8363081913919019eedbaf9d5c66aa
Opcode Fuzzy Hash: 13827038857effc63ef82136b442e555c97f8c0695d67c90c2aa9cf4ab0f3b8c
Instruction Fuzzy Hash: E5919DB2900E048FC706CF78EC4577DBBB5BB89345F048319E705AB2A1EB716485CB56

Function 00CA0E80 Relevance: 9.3, APIs: 6, Instructions: 286
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00CA1037

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 0009cc7bc04e5580c58a850b0e0f765266d6bc0c9d2b5b46de2489e81a114f90
Instruction ID: ff41a4f1b7eac25fe0bb7296596fe0fdcaf3382a313f58b15a420dae7003889e
Opcode Fuzzy Hash: 0009cc7bc04e5580c58a850b0e0f765266d6bc0c9d2b5b46de2489e81a114f90
Instruction Fuzzy Hash: 19E19C75C00A499FCB06CFB9E8817ADBBB1BF89344F148349DA0677261EB706985CF51

Function 00CAD5E0 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 00CAD685

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: CtrlDispatcherServiceStart
String ID:
API String ID: 3789849863-0
Opcode ID: 4952fe705ea22a0fcf40c29eb6648a2437aab8e8c1181d151af2ee07923f41d7
Instruction ID: 700b9d88821df8237b18911c553d7d0780c8e14f642dbf827865bb8d2e237fe3
Opcode Fuzzy Hash: 4952fe705ea22a0fcf40c29eb6648a2437aab8e8c1181d151af2ee07923f41d7
Instruction Fuzzy Hash: BF010571800E499EC702DFA9EC647BEBBB4FF8A341F408709DA0576220EBB051C5CB92

Function 00CAACD0 Relevance: 30.7, APIs: 15, Strings: 2, Instructions: 936
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00CF6DB8), ref: 00CAAD42

Part of subcall function 00C9A200: AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00C9A311
Part of subcall function 00C9A200: CheckTokenMembership.KERNELBASE(00000000,?,00000000), ref: 00C9A349

Part of subcall function 00C96CA0: GetProcAddress.KERNEL32(74DD0000,?), ref: 00C96CE8
Part of subcall function 00C96CA0: GetCurrentProcess.KERNEL32(00000000), ref: 00C96D82

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00CAAE1E
DeleteFileA.KERNELBASE(00000000,?,?,?,?,?,?), ref: 00CAB079
RemoveDirectoryA.KERNELBASE(00000000,?,?,?,?,?,?), ref: 00CAB0D8

Part of subcall function 00C9E620: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00C9E679

CreateDirectoryA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?), ref: 00CAB200
CreateDirectoryA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,?), ref: 00CAB275

Part of subcall function 00CA5BB0: _memset.LIBCMT ref: 00CA5C01
Part of subcall function 00CA5BB0: _free.LIBCMT ref: 00CA5C43

__snprintf.LIBCMT ref: 00CAB516
__snprintf.LIBCMT ref: 00CAB55E
CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00CAB624
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00CAB692
GetTempPathA.KERNEL32(00000104,00000000,?,?,?,?,?,?), ref: 00CAB7D5
CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?), ref: 00CAB8FB

Part of subcall function 00CB8900: _malloc.LIBCMT ref: 00CB897B

Part of subcall function 00CA4360: CreateFileA.KERNELBASE(00000002,40000000,00000000,00000000,00000002,00000000,00000000,00000000,?,?,?,?,?,?,00001000), ref: 00CA4409

GetTempPathA.KERNEL32(00000104,00000000,?,?,?,?,?,?), ref: 00CABA2E
SetFileAttributesA.KERNELBASE(00000000,00000002,?,?,?,?,?,?,?), ref: 00CABBEE
_memset.LIBCMT ref: 00CABCFC

Strings

\, xrefs: 00CAAD7E
C:\Windows\system32\config\systemprofile, xrefs: 00CAB4FE, 00CAB546

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: Directory$Create$File$PathTemp__snprintf_memset$AddressAllocateAttributesCheckCurrentDeleteInitializeMembershipProcProcessRemoveTokenVersionWindows_free_malloc
String ID: C:\Windows\system32\config\systemprofile$\
API String ID: 3801090003-3206176487
Opcode ID: 420f4ccfc0eb2c495f542f94d23287f7b76166deb60bb35d0670848346ac2791
Instruction ID: 6545c72c1f889b6f9f15612dc1649acad3fecdecb970fa1b80dd448cf994e410
Opcode Fuzzy Hash: 420f4ccfc0eb2c495f542f94d23287f7b76166deb60bb35d0670848346ac2791
Instruction Fuzzy Hash: F7A28C75D00A598FCB15CFA8DC91BEDBBB1BF4A304F148299E60A77252EB701A84CF51

Function 00CBEEA4 Relevance: 24.1, APIs: 16, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___security_init_cookie.LIBCMT ref: 00CBEEA4
___crtGetShowWindowMode.LIBCMT ref: 00CBEEBA

Part of subcall function 00CC08F3: GetStartupInfoW.KERNEL32(?), ref: 00CC08FD

_fast_error_exit.LIBCMT ref: 00CBEF1D
_fast_error_exit.LIBCMT ref: 00CBEF2E
__RTC_Initialize.LIBCMT ref: 00CBEF34
__ioinit.LIBCMT ref: 00CBEF3D
_fast_error_exit.LIBCMT ref: 00CBEF48
GetCommandLineA.KERNEL32(00CF3DE8,00000014), ref: 00CBEF4E
___crtGetEnvironmentStringsA.LIBCMT ref: 00CBEF59
__setargv.LIBCMT ref: 00CBEF63
__amsg_exit.LIBCMT ref: 00CBEF6E
__setenvp.LIBCMT ref: 00CBEF74
__amsg_exit.LIBCMT ref: 00CBEF7F
__cinit.LIBCMT ref: 00CBEF87
__amsg_exit.LIBCMT ref: 00CBEF92
__wincmdln.LIBCMT ref: 00CBEF98

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: __amsg_exit_fast_error_exit$___crt$CommandEnvironmentInfoInitializeLineModeShowStartupStringsWindow___security_init_cookie__cinit__ioinit__setargv__setenvp__wincmdln
String ID:
API String ID: 722230336-0
Opcode ID: 6c55ba77f48671b679285f8478f9e836e2c7b5cd27957cb9d606a7182a452543
Instruction ID: 8e4b9662a00be742f809805d04109496e321d685b62c83527298140d856e2e68
Opcode Fuzzy Hash: 6c55ba77f48671b679285f8478f9e836e2c7b5cd27957cb9d606a7182a452543
Instruction Fuzzy Hash: 4821C42164435599EB207BF4DC8BFFD22646F10B15F24416EFA089A1D3EEB4CA81B253

Function 00C9A5B0 Relevance: 17.3, APIs: 11, Instructions: 816
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CB8E80: __time64.LIBCMT ref: 00CB8E87

Part of subcall function 00CB8900: _malloc.LIBCMT ref: 00CB897B

Part of subcall function 00CA5BB0: _memset.LIBCMT ref: 00CA5C01
Part of subcall function 00CA5BB0: _free.LIBCMT ref: 00CA5C43

__snprintf.LIBCMT ref: 00C9ADAE
socket.WS2_32(00000002,00000001,00000006), ref: 00C9AF5F
setsockopt.WS2_32(000000FF,0000FFFF,00001006,00000000,00000004), ref: 00C9AF95
gethostbyname.WS2_32(?), ref: 00C9AFA2
inet_ntoa.WS2_32(00000000), ref: 00C9AFEE
inet_addr.WS2_32(00000000), ref: 00C9AFF5
htons.WS2_32(00000050), ref: 00C9B003
connect.WS2_32(000000FF,?,00000010), ref: 00C9B01D
send.WS2_32(000000FF,00000000,00000000,00000000), ref: 00C9B089
recv.WS2_32(000000FF,?,00000400,00000000), ref: 00C9B139
closesocket.WS2_32(000000FF), ref: 00C9B3D1

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: __snprintf__time64_free_malloc_memsetclosesocketconnectgethostbynamehtonsinet_addrinet_ntoarecvsendsetsockoptsocket
String ID:
API String ID: 4080495170-0
Opcode ID: 02159a312feab88f798ab0f6f946eb5570c3f81aad34bdfcd97b8aafe9140f57
Instruction ID: 4f674dd957bf8fa1d1744edfc8135ea8728e69be06116f94fd3037ada90a3b09
Opcode Fuzzy Hash: 02159a312feab88f798ab0f6f946eb5570c3f81aad34bdfcd97b8aafe9140f57
Instruction Fuzzy Hash: E7826A71C00E499FCB06CFB4EC91BADB775BF89344F108249E6067A2A1EB706985DF52

Function 00CA7C00 Relevance: 12.1, APIs: 8, Instructions: 84
registrysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(014AF3B0,Function_00015800), ref: 00CA7C94
SetServiceStatus.SECHOST(014B6AE0,00CF7070), ref: 00CA7CC2
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00CA7CD0
SetServiceStatus.ADVAPI32(014B6AE0,00CF7070), ref: 00CA7D1E
WaitForSingleObject.KERNEL32(00000210,00001388), ref: 00CA7D2F
SetServiceStatus.ADVAPI32(014B6AE0,00CF7070), ref: 00CA7D61
CloseHandle.KERNEL32(00000210), ref: 00CA7D6D
SetServiceStatus.ADVAPI32(014B6AE0,00CF7070), ref: 00CA7DBB

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID:
API String ID: 3399922960-0
Opcode ID: 180feeaa8243059334148ca80c75433ba84f5f6cb0fc6e346924714d48098706
Instruction ID: 56380bf0c14441ecbcfd72e734667b2e9d59f0bb8f7c632284e1afab61dffe12
Opcode Fuzzy Hash: 180feeaa8243059334148ca80c75433ba84f5f6cb0fc6e346924714d48098706
Instruction Fuzzy Hash: B44103B1508B009FD305CF34FCA9B7E7BB9BB48744F408309E602962B0DBB9548ADB46

Function 00C97390 Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 410
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

C:\bamqdjw\czmruiag.exe, xrefs: 00C97ABE
Z, xrefs: 00C976E2
ulazkbbwltmi "c:\bamqdjw\erewpegtq.exe", xrefs: 00C97AB9

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: CountSystemTickTime_malloc
String ID: C:\bamqdjw\czmruiag.exe$Z$ulazkbbwltmi "c:\bamqdjw\erewpegtq.exe"
API String ID: 3770554779-2861834451
Opcode ID: 0d7cd7d252ea47d970737cac48136aea5cda47d3eebd1575e68bde5efd385a4c
Instruction ID: b4b00b573e242a7a82dc561527c3ba56611fe2ac876eadfca01f48547c2da807
Opcode Fuzzy Hash: 0d7cd7d252ea47d970737cac48136aea5cda47d3eebd1575e68bde5efd385a4c
Instruction Fuzzy Hash: 84128C71C10A489FCB06DFB4EC91BADB775BF59340F108259E60677261EB706A84CF52

Function 00C976A3 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 279
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000008AE), ref: 00C97A4D

Part of subcall function 00CB8900: _malloc.LIBCMT ref: 00CB897B

Part of subcall function 00CA5BB0: _memset.LIBCMT ref: 00CA5C01
Part of subcall function 00CA5BB0: _free.LIBCMT ref: 00CA5C43

_memset.LIBCMT ref: 00C979B3

Strings

C:\bamqdjw\czmruiag.exe, xrefs: 00C97ABE
Z, xrefs: 00C976E2
ulazkbbwltmi "c:\bamqdjw\erewpegtq.exe", xrefs: 00C97AB9

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: _memset$Sleep_free_malloc
String ID: C:\bamqdjw\czmruiag.exe$Z$ulazkbbwltmi "c:\bamqdjw\erewpegtq.exe"
API String ID: 3151160524-2861834451
Opcode ID: 3d358bb6c57feb7312c96276f68ea32565d85ec13213881736f6b132938fc442
Instruction ID: cf45fa310e8e1e8de320c586ff20f6058675f1d7d57f9ff4a7df5da85ab39f00
Opcode Fuzzy Hash: 3d358bb6c57feb7312c96276f68ea32565d85ec13213881736f6b132938fc442
Instruction Fuzzy Hash: 53C16FB5C10A08DFCB06DFA4EC91BADB775BF49300F148259E609B7261EB706A84DF52

Function 00CA7E90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00CA7EFC
CreateProcessA.KERNELBASE(?,00C97AC8,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?), ref: 00CA7F50
CloseHandle.KERNEL32(00C97AC8), ref: 00CA7F5E
CloseHandle.KERNEL32(?), ref: 00CA7F68

Strings

D, xrefs: 00CA7F04

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: CloseHandle$CreateProcess_memset
String ID: D
API String ID: 3113380336-2746444292
Opcode ID: b4b88ef281f8f9db55cdbe5d5bbab1d506bf3db4cce3c2801c7362db82651503
Instruction ID: cb84fef5c49de2710d51196a7f47b50fbac341d78ee9d097d8504447888af361
Opcode Fuzzy Hash: b4b88ef281f8f9db55cdbe5d5bbab1d506bf3db4cce3c2801c7362db82651503
Instruction Fuzzy Hash: BF314DB1910B489FC701CFB8DC41B6DB7B5AF89744F208315E70AAB2A4E7706584CB15

Function 00CA9EE0 Relevance: 7.7, APIs: 5, Instructions: 196
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00CAA00D
Process32First.KERNEL32(00000000,00000128), ref: 00CAA04D
Process32Next.KERNEL32(00000000,00000128), ref: 00CAA206
CloseHandle.KERNELBASE(00000000), ref: 00CAA218
_memset.LIBCMT ref: 00CAA261

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memset
String ID:
API String ID: 2526126748-0
Opcode ID: be96fe7ba5def83a7ea46d1979cd899285425d6b13f24edcd327dfe42d3d7575
Instruction ID: acee5414c90e54facf4095cd0f1445e522fea4f185f50e289d43064aa4e50b08
Opcode Fuzzy Hash: be96fe7ba5def83a7ea46d1979cd899285425d6b13f24edcd327dfe42d3d7575
Instruction Fuzzy Hash: EBA19871C00A0ADECB05CFB9E8807BDBBB1BF49344F148249D6157A260E77516C9CF96

Function 00CA8370 Relevance: 5.0, APIs: 3, Instructions: 544
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameA.KERNEL32(?,00000010), ref: 00CA8480
_memset.LIBCMT ref: 00CA883F

Part of subcall function 00C9C910: _memset.LIBCMT ref: 00C9C96A

Part of subcall function 00CA5770: _memset.LIBCMT ref: 00CA579A

Part of subcall function 00C92510: __snprintf.LIBCMT ref: 00C9266B
Part of subcall function 00C92510: __snprintf.LIBCMT ref: 00C926AD

Part of subcall function 00CA5980: Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00CA59E9

_memset.LIBCMT ref: 00CA8D40

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: _memset$__snprintf$Affinity::operator!=ComputerConcurrency::details::HardwareName
String ID:
API String ID: 3175924889-0
Opcode ID: 14488bb49e5c49cd6db787f50cd38edb21acf009c340200e6521eaad6793f19f
Instruction ID: 8d8d1d4ad4593b9d25d8be913a93f4d18f069dc1b88990750577388fa1ec91d0
Opcode Fuzzy Hash: 14488bb49e5c49cd6db787f50cd38edb21acf009c340200e6521eaad6793f19f
Instruction Fuzzy Hash: D5428C71C00A498FCB06DFB8EC917ADBB75BF59344F10825AE60A7B261EB702589CF51

Function 00C9A200 Relevance: 4.6, APIs: 3, Instructions: 123
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00C9A311
CheckTokenMembership.KERNELBASE(00000000,?,00000000), ref: 00C9A349
FreeSid.ADVAPI32(?), ref: 00C9A42F

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: c196149d386da4de289ff81c6de196cc5cb2ac4c8af37bab43a12a6b4d1f70ac
Instruction ID: 205da65c2cf6ecd40f8d86620f628faea981354ff2d755d1a12daff4e92c2adf
Opcode Fuzzy Hash: c196149d386da4de289ff81c6de196cc5cb2ac4c8af37bab43a12a6b4d1f70ac
Instruction Fuzzy Hash: 5A517971800E498EC706CF79EC9537EBB74BF99384F10830AD706BA161EB706585CB86

Function 00CA4360 Relevance: 4.6, APIs: 3, Instructions: 121
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C91DA0: WaitForSingleObject.KERNEL32(00000114,00004E20,?,?,?,?,00CA686C,00000114,?), ref: 00C91EBC

CreateFileA.KERNELBASE(00000002,40000000,00000000,00000000,00000002,00000000,00000000,00000000,?,?,?,?,?,?,00001000), ref: 00CA4409

Part of subcall function 00C96DF0: ReleaseMutex.KERNEL32(00CA6B5F,?,00CA6B5F,00000114,?), ref: 00C96E07

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: CreateFileMutexObjectReleaseSingleWait
String ID:
API String ID: 1564016613-0
Opcode ID: a76693e6e1b933d8e94beca143cd8e8a736f73180ed505a0f2f1d430e2e0f50d
Instruction ID: 5f6720b5059ca40fbf9703ad22db173e495791c6780febaf240f4a5a45a0076b
Opcode Fuzzy Hash: a76693e6e1b933d8e94beca143cd8e8a736f73180ed505a0f2f1d430e2e0f50d
Instruction Fuzzy Hash: D951C675900A08EFC705CFB5EC85B6EB374AF88344F10C719E6056B2A1E7706984DF92

Function 00CB94DD Relevance: 4.5, APIs: 3, Instructions: 29
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 00CB94F5

Part of subcall function 00CBA6FD: __FF_MSGBANNER.LIBCMT ref: 00CBA714
Part of subcall function 00CBA6FD: __NMSG_WRITE.LIBCMT ref: 00CBA71B
Part of subcall function 00CBA6FD: RtlAllocateHeap.NTDLL(014A0000,00000000,00000001,00000000,00000000,00000000,?,00CBFCE1,00000000,00000000,00000000,00000000,?,00CC05F7,00000018,00CF3E08), ref: 00CBA740

std::exception::exception.LIBCMT ref: 00CB9513
__CxxThrowException@8.LIBCMT ref: 00CB9528

Part of subcall function 00CBF37C: RaiseException.KERNEL32(?,?,?,00CF3AD0,?,?,?,?,?,00CB952D,?,00CF3AD0,00000000,00000001), ref: 00CBF3D1

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID:
API String ID: 3074076210-0
Opcode ID: 99b2ec322f979217df726e5ce6217f817063b13024d72d55e4d620b3ba89c9a7
Instruction ID: 313c661a2abc0442746e9f98e928c8245f9ab869b25f9cf9c9d38d044de9764a
Opcode Fuzzy Hash: 99b2ec322f979217df726e5ce6217f817063b13024d72d55e4d620b3ba89c9a7
Instruction Fuzzy Hash: DDE06DB090024EBBCF11EEA5DC429EE7BACEB00304F10456AFD15A6291DF719B56AA91

Function 00CA1A50 Relevance: 3.1, APIs: 2, Instructions: 108fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 00CA1BA2
_memset.LIBCMT ref: 00CA1BD4

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: CreateFile_memset
String ID:
API String ID: 3830271748-0
Opcode ID: e10c6dd9868bd27270e2deae009816f6d450e6d2368c479c3d38e2c0d7274b7c
Instruction ID: 2cab58ebf4216f4b08f3b63c18d185a9383db70a0d7ceafdb7215f21fd50da9a
Opcode Fuzzy Hash: e10c6dd9868bd27270e2deae009816f6d450e6d2368c479c3d38e2c0d7274b7c
Instruction Fuzzy Hash: 4341C070D007099FCB01CFA4EC42BFDBBB1AF45314F148259EA1577291EB742A88CB51

Function 00CBAB1C Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CC0F5A: __getptd_noexit.LIBCMT ref: 00CC0F5A

__lock_file.LIBCMT ref: 00CBAB61

Part of subcall function 00CC3E42: __lock.LIBCMT ref: 00CC3E65

__fclose_nolock.LIBCMT ref: 00CBAB6C

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 22c8e4b690f08dfcbaf53d6335d900248969450d25ac781feeba3ce8458bf1b2
Instruction ID: ca95db12084d5c14ba583dd8c62a9fd90abb78131ee7f61f92063778f7cc28de
Opcode Fuzzy Hash: 22c8e4b690f08dfcbaf53d6335d900248969450d25ac781feeba3ce8458bf1b2
Instruction Fuzzy Hash: 33F0B4318003059FDB11BB798802BEEAA916F01731F20811DE4B4AB2C2CB7C8A02BB56

Function 00CCE043 Relevance: 3.0, APIs: 2, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringEx.KERNELBASE(?,?,?,?,?,5EFC4D8B,00000000,00000000,00000000,?,00CCEAA4,?,?,00000000,?,00000000), ref: 00CCE06A
LCMapStringW.KERNEL32(00000000,?,?,?,?,5EFC4D8B,?,00CCEAA4,?,?,00000000,?,00000000,00000000), ref: 00CCE087

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 1a598209603559ca500e59da6cc8dbc45061e5cb2ba3db3be18971c3ac7f1620
Instruction ID: 13a1fa91db1be1dee2a4da53a15a96b7b601d549ecb9a60c0665b182d617e12b
Opcode Fuzzy Hash: 1a598209603559ca500e59da6cc8dbc45061e5cb2ba3db3be18971c3ac7f1620
Instruction Fuzzy Hash: CCF01F7201020DBFDF069F94EC4AEAE3F6AFB48350B108519FA1949020D772A972EB95

Function 00CA2280 Relevance: 2.8, APIs: 1, Instructions: 1305COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CA3AAC

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 773ecb3a05d8263c983910361baf20f65f4fdd328b55986af03edbc6aa25d1f0
Instruction ID: 2d3ce16cdcaa5128342cf234bfad6af71cfcad6032ab03fd50f477d63e2d4505
Opcode Fuzzy Hash: 773ecb3a05d8263c983910361baf20f65f4fdd328b55986af03edbc6aa25d1f0
Instruction Fuzzy Hash: 30F21372810E898EC306CF79ED9133EBB75BF9A385714930AD7067A235EB706085DB46

Function 00CBAE47 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 00CBAE52

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction ID: 2db6cc7c4beec2f855ed66c374395357810e03bba7131e490f9bdea37269b901
Opcode Fuzzy Hash: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction Fuzzy Hash: 0FB0927244020C77CE022A92EC02A893B199B40765F008061FB0C18561A673A660A68A

Function 00C92240 Relevance: 1.3, APIs: 1, Instructions: 80sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,?,?,?,?,?,?,00C9763B,?), ref: 00C922FA

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 546356459bb1e47e51c5db293f082bfa14034b89e7949886a66f4dcd0472c87d
Instruction ID: f0470b3733926b47bc2ceb355b1496d595991f75063ec4aca44749bcf07b200d
Opcode Fuzzy Hash: 546356459bb1e47e51c5db293f082bfa14034b89e7949886a66f4dcd0472c87d
Instruction Fuzzy Hash: 8031C1B5D00608AFEB00DBE8EC42BAD7774AF45305F14C158E7046B2D1E6726754DB53

Non-executed Functions

Function 00CBF9CE Relevance: 15.2, APIs: 10, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetLocaleInfoA.LIBCMT ref: 00CBFA20

Part of subcall function 00CCDD22: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00CCDD2E
Part of subcall function 00CCDD22: __crtGetLocaleInfoA_stat.LIBCMT ref: 00CCDD43

GetLastError.KERNEL32(?,?,?,00000000), ref: 00CBFA32
___crtGetLocaleInfoA.LIBCMT ref: 00CBFA52
___crtGetLocaleInfoA.LIBCMT ref: 00CBFA94
__calloc_crt.LIBCMT ref: 00CBFA67

Part of subcall function 00CBFC83: __calloc_impl.LIBCMT ref: 00CBFC92

__calloc_crt.LIBCMT ref: 00CBFAA9
_free.LIBCMT ref: 00CBFAC1
_free.LIBCMT ref: 00CBFB01
__calloc_crt.LIBCMT ref: 00CBFB2B
_free.LIBCMT ref: 00CBFB51

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: Locale$Info$___crt__calloc_crt_free$A_statErrorLastUpdateUpdate::___calloc_impl__crt
String ID:
API String ID: 1754018987-0
Opcode ID: ae53852d2d39577802c41de8948aaabfab417c4fc1bfca4e6fdf686ee583c3b7
Instruction ID: a0e7819898ef446f7a0849b8c199d2852d5f4ad09aee99db85769c146f4e5844
Opcode Fuzzy Hash: ae53852d2d39577802c41de8948aaabfab417c4fc1bfca4e6fdf686ee583c3b7
Instruction Fuzzy Hash: 5951927190021AABDF249F65CC51FEABBB9EF14710F1440BDF849D2241EB31DE51AB60

Function 00CA8DE0 Relevance: 13.6, APIs: 9, Instructions: 132serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 00CA8E53
CreateServiceA.ADVAPI32(00000000,014AF3B0,014AF3B0,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00CA8E94
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00CA8F35
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00CA8F6C
CloseServiceHandle.ADVAPI32(00000000), ref: 00CA8F76
OpenServiceA.ADVAPI32(00000000,014AF3B0,00000010), ref: 00CA8FD5
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00CA8FEC
CloseServiceHandle.ADVAPI32(00000000), ref: 00CA8FF6
CloseServiceHandle.ADVAPI32(00000000), ref: 00CA9000

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
String ID:
API String ID: 3525021261-0
Opcode ID: bbdc193a8be55b641572746d299c761ffa8a25381da9aaa1158ba0a78e21bd52
Instruction ID: ae2037fbb98386191dea6c2c94532ef0bd09b4d52b94164d3a7171896303c7c9
Opcode Fuzzy Hash: bbdc193a8be55b641572746d299c761ffa8a25381da9aaa1158ba0a78e21bd52
Instruction Fuzzy Hash: F4510871900E049FC306DFB8EC64B7EBB75BF89745F108319E706AA2A0EB716481CB46

Function 00CAC5C0 Relevance: 12.2, APIs: 8, Instructions: 169serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00CAC644
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,?,?,00000000), ref: 00CAC6C5
GetLastError.KERNEL32 ref: 00CAC6CE
_malloc.LIBCMT ref: 00CAC70F
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,?,00000000), ref: 00CAC740
__snprintf.LIBCMT ref: 00CAC7A9
_free.LIBCMT ref: 00CAC7EF
CloseServiceHandle.ADVAPI32(00000000), ref: 00CAC7FB

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenService__snprintf_free_malloc
String ID:
API String ID: 3403677689-0
Opcode ID: 92b2e3d7f65e287abfebd68dbcaa02db662624061b71f7df23572e5dfb73785e
Instruction ID: fa7fbaf898bd01afc315ba2ffcdd4ee491d7b435bb56f35da527c8545f4312b4
Opcode Fuzzy Hash: 92b2e3d7f65e287abfebd68dbcaa02db662624061b71f7df23572e5dfb73785e
Instruction Fuzzy Hash: 8671A171D00A09DFCB05CFA4DC95BBEBBB9BF89344F108219E602BA190E7715A85CF52

Function 00CDEE73 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00CDEE8A
_wcscmp.LIBCMT ref: 00CDEE9B
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00CDF139,?,00000000), ref: 00CDEEB7
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00CDF139,?,00000000), ref: 00CDEEE1

Strings

ACP, xrefs: 00CDEE84
OCP, xrefs: 00CDEE95

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: 8683561d9a8ae5378e1d3f273a8c11facfc77ed7b813ce27293ad8838d3d4e4b
Instruction ID: 5f61ec285706ce3bb2cac74e3dded36a8a2fe0d518cae59311bc877779482602
Opcode Fuzzy Hash: 8683561d9a8ae5378e1d3f273a8c11facfc77ed7b813ce27293ad8838d3d4e4b
Instruction Fuzzy Hash: 0301DE32200259BADB20EE65DC45FDA3399AF00760F048422FB18DE692E730EB80D7D1

Function 00CA1570 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 194pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32(00000020,?,0000000C,00000000), ref: 00CA1666

Strings

D, xrefs: 00CA16F6

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: CreatePipe
String ID: D
API String ID: 2719314638-2746444292
Opcode ID: 567a6a1dd554a942784e3a0fa80f15b1880c665358248c443870e51ee4c34083
Instruction ID: b6b393847d5fad7dfdde911bd626b20a2fe062c1eca36907996dd3425365d85d
Opcode Fuzzy Hash: 567a6a1dd554a942784e3a0fa80f15b1880c665358248c443870e51ee4c34083
Instruction Fuzzy Hash: 48814BB5E00609EFCB04CFA4DD85BEEBBB5FF88704F108619E605A7290DB756984CB51

Function 00CCFA4C Relevance: 19.6, APIs: 13, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00CCFA63

Part of subcall function 00CBFC83: __calloc_impl.LIBCMT ref: 00CBFC92

__calloc_crt.LIBCMT ref: 00CCFA87
_free.LIBCMT ref: 00CCFA95
__calloc_crt.LIBCMT ref: 00CCFAA3
_free.LIBCMT ref: 00CCFAB3
_free.LIBCMT ref: 00CCFAB9
__copytlocinfo_nolock.LIBCMT ref: 00CCFAC8
__wsetlocale_nolock.LIBCMT ref: 00CCFAD5
__setmbcp_nolock.LIBCMT ref: 00CCFAE9
_free.LIBCMT ref: 00CCFAF7
___removelocaleref.LIBCMT ref: 00CCFAFE
___freetlocinfo.LIBCMT ref: 00CCFB05
_free.LIBCMT ref: 00CCFB0B

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: dbbea71aa0ff378f1c890ac40a9f3fb821f1545db0178139ff153139d5a3569e
Instruction ID: 4c1ffe5b671f3f5184848bce9764fdb12cf75df357a1be2e684a73479b74ff32
Opcode Fuzzy Hash: dbbea71aa0ff378f1c890ac40a9f3fb821f1545db0178139ff153139d5a3569e
Instruction Fuzzy Hash: 52215B31104605AAEB317F65DC02F9ABBEADF41791F21803EF49885162DB318952B795

Function 00CBA194 Relevance: 18.1, APIs: 12, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00CBA19C
_free.LIBCMT ref: 00CBA1B5

Part of subcall function 00CBA688: RtlFreeHeap.NTDLL(00000000,00000000,?,00CC2938,00000000,00CC0F5F,00CCE22D,00000000,?,00CBFC97,?,?,00000000), ref: 00CBA69C
Part of subcall function 00CBA688: GetLastError.KERNEL32(00000000,?,00CC2938,00000000,00CC0F5F,00CCE22D,00000000,?,00CBFC97,?,?,00000000,?,?,?,00CC2A32), ref: 00CBA6AE

_free.LIBCMT ref: 00CBA1C8
_free.LIBCMT ref: 00CBA1E6
_free.LIBCMT ref: 00CBA1F8
_free.LIBCMT ref: 00CBA209
_free.LIBCMT ref: 00CBA214
_free.LIBCMT ref: 00CBA238
EncodePointer.KERNEL32(014AF9F0), ref: 00CBA23F
_free.LIBCMT ref: 00CBA254
_free.LIBCMT ref: 00CBA26A
_free.LIBCMT ref: 00CBA292

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: 4d234502ac84b4deeecda77cea3964e9730f2d69cb0835f9692280783b14ce87
Instruction ID: 791603eafbfc2826a20a641e1a37e3e997e7934d8d55a44225e92d899b5257eb
Opcode Fuzzy Hash: 4d234502ac84b4deeecda77cea3964e9730f2d69cb0835f9692280783b14ce87
Instruction Fuzzy Hash: BD219FB29492509FCB255F28FD407AD77B8EB04762F0A022BF99897260CB315D41DB87

Function 00CCFB23 Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00CCFBAD
__lock.LIBCMT ref: 00CCFBC3
__copytlocinfo_nolock.LIBCMT ref: 00CCFBD4
__wsetlocale_nolock.LIBCMT ref: 00CCFBEB
_wcscmp.LIBCMT ref: 00CCFC0E
__lock.LIBCMT ref: 00CCFC25
__updatetlocinfoEx_nolock.LIBCMT ref: 00CCFC37
___removelocaleref.LIBCMT ref: 00CCFC3D
__updatetlocinfoEx_nolock.LIBCMT ref: 00CCFC5C

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock_wcscmp
String ID:
API String ID: 1077091919-0
Opcode ID: 6c27296af4e36b976b194c282cbc25807f59e7397a92f871780b343ed0997a7f
Instruction ID: def1ef7c5ae79777a619adc9782bece3b0ce691d51500e85561f4bff115c8c37
Opcode Fuzzy Hash: 6c27296af4e36b976b194c282cbc25807f59e7397a92f871780b343ed0997a7f
Instruction Fuzzy Hash: D7410632904309ABDB21AFA8DC42FAD77F1EF04314F20403DF91496292DB759A46EB51

Function 00CB9385 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00CB9398

Part of subcall function 00CBF19F: std::exception::_Copy_str.LIBCMT ref: 00CBF1B8

__CxxThrowException@8.LIBCMT ref: 00CB93AD

Part of subcall function 00CBF37C: RaiseException.KERNEL32(?,?,?,00CF3AD0,?,?,?,?,?,00CB952D,?,00CF3AD0,00000000,00000001), ref: 00CBF3D1

std::exception::exception.LIBCMT ref: 00CB93C6
__CxxThrowException@8.LIBCMT ref: 00CB93DB
std::regex_error::regex_error.LIBCPMT ref: 00CB93ED

Part of subcall function 00CB905C: std::exception::exception.LIBCMT ref: 00CB9076

__CxxThrowException@8.LIBCMT ref: 00CB93FB
std::exception::exception.LIBCMT ref: 00CB9414
__CxxThrowException@8.LIBCMT ref: 00CB9429

Strings

bad function call, xrefs: 00CB942F

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: 79aaa388e7bb31dbcfcd5167ab8b352f12bada0a883949ea70621a47df1352fb
Instruction ID: 557fa2f45122a72d21b1e8f2394fc6c0ce3743bb2ed8b9f9d0027a17d4001b68
Opcode Fuzzy Hash: 79aaa388e7bb31dbcfcd5167ab8b352f12bada0a883949ea70621a47df1352fb
Instruction Fuzzy Hash: 1511AA74C0024CBB8F04EFA5C886CDDBBBCEA18344F408566B92497251EB74A74A8B91

Function 00C98040 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 308sleepfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA5BB0: _memset.LIBCMT ref: 00CA5C01
Part of subcall function 00CA5BB0: _free.LIBCMT ref: 00CA5C43

GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 00C9839B
__snprintf.LIBCMT ref: 00C983FE
_memset.LIBCMT ref: 00C98505
_memset.LIBCMT ref: 00C9851B
Sleep.KERNEL32(00015F90), ref: 00C98528
DeleteFileA.KERNEL32(?), ref: 00C98535
_memset.LIBCMT ref: 00C98549

Strings

rj3., xrefs: 00C9844B

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: _memset$File$DeleteModuleNameSleep__snprintf_free
String ID: rj3.
API String ID: 3733618472-2374996226
Opcode ID: 2893cf870747fc1e03e234229a1d00616bdc3747bfd54bffc47d362114ffe875
Instruction ID: 904591273630ce46b62c11cf3ecdb8e8b52c6964426fd7800678ce8847ec923d
Opcode Fuzzy Hash: 2893cf870747fc1e03e234229a1d00616bdc3747bfd54bffc47d362114ffe875
Instruction Fuzzy Hash: 52D1DE71800A089FCB05DBB9EC85BBDB775BF89301F148719E705BB2A1EB716588CB52

Function 00CA16AA Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 81processfileCOMMON

Download Yara Rule

APIs

SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 00CA16CF
_memset.LIBCMT ref: 00CA16EE
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 00CA1752
WriteFile.KERNEL32(00000000,00000000,00000020,?,00000000), ref: 00CA178D
CloseHandle.KERNEL32(00000000), ref: 00CA181F
CloseHandle.KERNEL32(00CA56E4), ref: 00CA1829
CloseHandle.KERNEL32(00000020), ref: 00CA1833
CloseHandle.KERNEL32(?), ref: 00CA1843

Strings

D, xrefs: 00CA16F6

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: Handle$Close$CreateFileInformationProcessWrite_memset
String ID: D
API String ID: 3900862288-2746444292
Opcode ID: 7403420be91dfdb0df791cfb84f53d1d24ac33ca96a21565b1eaee63851b7d15
Instruction ID: 97a7d23f33aca5965a3b6b5236afbed2a3bca9794512a7c56e02ece5b0b573ae
Opcode Fuzzy Hash: 7403420be91dfdb0df791cfb84f53d1d24ac33ca96a21565b1eaee63851b7d15
Instruction Fuzzy Hash: FB3127B1E00708EFDB14CFA5DD86BEDBBB5BF88704F108519E605AB290DB746A80CB51

Function 00C98E40 Relevance: 12.3, APIs: 8, Instructions: 271fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00C98EF2
ReadFile.KERNEL32(000000FF,?,?,?,00000000), ref: 00C98F17
CloseHandle.KERNEL32(000000FF), ref: 00C98F35
GetTickCount.KERNEL32 ref: 00C98F4C

Part of subcall function 00CB8900: _malloc.LIBCMT ref: 00CB897B

_sprintf.LIBCMT ref: 00C99145
CreateFileA.KERNEL32(00000001,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00C9916E
WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 00C991DC
CloseHandle.KERNEL32(000000FF), ref: 00C991E6

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWrite_malloc_sprintf
String ID:
API String ID: 3359727986-0
Opcode ID: 1a9f12563200eb4e31956d068a5170765c1610927b6967c1c19dd4da9eb794d5
Instruction ID: 83c831602db49086066b614417e38353296f72a004119ca722066c4fcd61eb7d
Opcode Fuzzy Hash: 1a9f12563200eb4e31956d068a5170765c1610927b6967c1c19dd4da9eb794d5
Instruction Fuzzy Hash: 49C16C75D00B489FCB05CFA8D855BAEFBB6BF89300F148209EA05B7351D7716985CB51

Function 00CA6E60 Relevance: 12.2, APIs: 8, Instructions: 212processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00CA6EEE
Process32First.KERNEL32(00000000,00000128), ref: 00CA6F71
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00CA70A5
TerminateProcess.KERNEL32(00000000,000000FF), ref: 00CA70F8
CloseHandle.KERNEL32(00000000), ref: 00CA7102
Process32Next.KERNEL32(00000000,00000128), ref: 00CA711D
CloseHandle.KERNEL32(00000000), ref: 00CA712F
_memset.LIBCMT ref: 00CA7143

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32_memset
String ID:
API String ID: 3095088415-0
Opcode ID: 21c10965c85c4723cbb32fd0696b2e1cc34481122598ab716bd1db74f83ed611
Instruction ID: d00025e8d1c308ecc12a5afcb6a76094619e8638034ab68ee0c79b2621efe9fc
Opcode Fuzzy Hash: 21c10965c85c4723cbb32fd0696b2e1cc34481122598ab716bd1db74f83ed611
Instruction Fuzzy Hash: 1AB15771C00A499EC706CFB8EC917BDFBB5BF8A384F108349D606B6261EB715585CB52

Function 00CA6030 Relevance: 12.2, APIs: 8, Instructions: 183processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00CA6094
Process32First.KERNEL32(00000000,00000128), ref: 00CA6155
__snprintf.LIBCMT ref: 00CA620C
CreateToolhelp32Snapshot.KERNEL32(00000008,?,00000000), ref: 00CA623A
Module32First.KERNEL32(0000000D,00000224), ref: 00CA62A8
CloseHandle.KERNEL32(0000000D,0000000A,?,00C9D9E3), ref: 00CA6311
Process32Next.KERNEL32(00000000,00000128), ref: 00CA632C

Part of subcall function 00CB8900: _malloc.LIBCMT ref: 00CB897B

Part of subcall function 00CA5BB0: _memset.LIBCMT ref: 00CA5C01
Part of subcall function 00CA5BB0: _free.LIBCMT ref: 00CA5C43

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32$CloseHandleModule32Next__snprintf_free_malloc_memset
String ID:
API String ID: 2771089087-0
Opcode ID: a0bdee5566b8a145cf2d63eb8fc047cd879b9a10bc33eb4bac286cefe26677d8
Instruction ID: c13486a868f870fa1b6dde6ad4e2b3c3048bd874a092a905e95e1fed2ce95d9a
Opcode Fuzzy Hash: a0bdee5566b8a145cf2d63eb8fc047cd879b9a10bc33eb4bac286cefe26677d8
Instruction Fuzzy Hash: A281CD71900A099FC705CFB8EC91BBDBB75BF49744F008259E709AB261EB705A85CF52

Function 00C9DE80 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 278COMMON

Download Yara Rule

Strings

#, xrefs: 00C9E2A3

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 1dfae7ffa53ab30f93312da8ebc1a113beb23cc2d9b57aa3cf4e378bee86d0ff
Instruction ID: a4e4140e2cbb614e8ef6eb73c46857a27b0ddbc7eb6a3100971b13173d2e5264
Opcode Fuzzy Hash: 1dfae7ffa53ab30f93312da8ebc1a113beb23cc2d9b57aa3cf4e378bee86d0ff
Instruction Fuzzy Hash: CDC1E170D00A49DFCF04CFB8D945BBDB7B2BFA5344F208259E606A72A1E7719A80DB51

Function 00CCAF7C Relevance: 10.6, APIs: 7, Instructions: 84COMMON

Download Yara Rule

APIs

___unDName.LIBCMT ref: 00CCAFAB
_strlen.LIBCMT ref: 00CCAFBE
__lock.LIBCMT ref: 00CCAFDA
_malloc.LIBCMT ref: 00CCAFEC
_malloc.LIBCMT ref: 00CCAFFD
_free.LIBCMT ref: 00CCB046

Part of subcall function 00CC047D: IsProcessorFeaturePresent.KERNEL32(00000017,00CC0451,00000000,?,?,?,?,?,00CC045E,00000000,00000000,00000000,00000000,00000000,00CCC360), ref: 00CC047F

_free.LIBCMT ref: 00CCB03F

Part of subcall function 00CBA688: RtlFreeHeap.NTDLL(00000000,00000000,?,00CC2938,00000000,00CC0F5F,00CCE22D,00000000,?,00CBFC97,?,?,00000000), ref: 00CBA69C
Part of subcall function 00CBA688: GetLastError.KERNEL32(00000000,?,00CC2938,00000000,00CC0F5F,00CCE22D,00000000,?,00CBFC97,?,?,00000000,?,?,?,00CC2A32), ref: 00CBA6AE

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: _free_malloc$ErrorFeatureFreeHeapLastNamePresentProcessor___un__lock_strlen
String ID:
API String ID: 3704956918-0
Opcode ID: e81d03b320182fac62ea21e3cb61267b0d8c4f60131e05ea8183fba84634b13d
Instruction ID: 738a799b4e3bdfcc13634744ec47096c46f88f063ac33fcaef7c6f5580f59b8b
Opcode Fuzzy Hash: e81d03b320182fac62ea21e3cb61267b0d8c4f60131e05ea8183fba84634b13d
Instruction Fuzzy Hash: EE2122F1900706ABDB24ABB4CC46F6BB7A8AF14350F14C12DF8289B282DB74DD41DB91

Function 00CC29FA Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00CC29FA

Part of subcall function 00CBA3DF: EncodePointer.KERNEL32(00000000,?,00CC29FF,00CBEF28,00CF3DE8,00000014), ref: 00CBA3E2
Part of subcall function 00CBA3DF: __initp_misc_winsig.LIBCMT ref: 00CBA3FD
Part of subcall function 00CBA3DF: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00CC09A3
Part of subcall function 00CBA3DF: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00CC09B7
Part of subcall function 00CBA3DF: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00CC09CA
Part of subcall function 00CBA3DF: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00CC09DD
Part of subcall function 00CBA3DF: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00CC09F0
Part of subcall function 00CBA3DF: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00CC0A03
Part of subcall function 00CBA3DF: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00CC0A16
Part of subcall function 00CBA3DF: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00CC0A29
Part of subcall function 00CBA3DF: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00CC0A3C
Part of subcall function 00CBA3DF: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00CC0A4F
Part of subcall function 00CBA3DF: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00CC0A62
Part of subcall function 00CBA3DF: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00CC0A75
Part of subcall function 00CBA3DF: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00CC0A88
Part of subcall function 00CBA3DF: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00CC0A9B
Part of subcall function 00CBA3DF: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00CC0AAE
Part of subcall function 00CBA3DF: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00CC0AC1

__mtinitlocks.LIBCMT ref: 00CC29FF
__mtterm.LIBCMT ref: 00CC2A08
__calloc_crt.LIBCMT ref: 00CC2A2D
__initptd.LIBCMT ref: 00CC2A4F
GetCurrentThreadId.KERNEL32 ref: 00CC2A56

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: AddressProc$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm
String ID:
API String ID: 1593083391-0
Opcode ID: 88d98a293d2c475ffc4624ae44caba3d07209e7fa2a3ac3e32800147b17aee29
Instruction ID: 634897edf90cc3a5c0f94fbb8fd0307048696863169ede7e04b2cc9ae77026b7
Opcode Fuzzy Hash: 88d98a293d2c475ffc4624ae44caba3d07209e7fa2a3ac3e32800147b17aee29
Instruction Fuzzy Hash: A9F090325197519DE638BB74FC03F9A2A849B01730F21062EF5B6D50E1FF11CA41B295

Function 00CA1D00 Relevance: 9.3, APIs: 6, Instructions: 252fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CA1F5C
_memset.LIBCMT ref: 00CA221F

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: CreateFile_memset
String ID:
API String ID: 3830271748-0
Opcode ID: a3910f1c7ffa3cfd79e51e87d16cabf9691a0b187883fd0a77ad9ebc729b82f8
Instruction ID: b0ebad9c8e5b3968a16a77569adbcf1cec732f5d148c7a1a88bbb9b2e1334f27
Opcode Fuzzy Hash: a3910f1c7ffa3cfd79e51e87d16cabf9691a0b187883fd0a77ad9ebc729b82f8
Instruction Fuzzy Hash: 04C15572810E498EC706CF7AEC8176DB775BF8A385B148705E7067A1B1EB706588DF42

Function 00CA5000 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 439COMMON

Download Yara Rule

Strings

, xrefs: 00CA5674
, xrefs: 00CA5322

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: _free_memset
String ID: $
API String ID: 287624719-227171996
Opcode ID: 4e71dc490fa195630b573629e2d19ab351c54c558b35b9b24400e61898c5a55b
Instruction ID: 0297d744080be19e74c26ce8933b563142f0105349f365994c8f91adebcfee66
Opcode Fuzzy Hash: 4e71dc490fa195630b573629e2d19ab351c54c558b35b9b24400e61898c5a55b
Instruction Fuzzy Hash: 62129F71C00E499FCB05CFA8EC81BADBBB5BF89345F148219E6057B261EB306585DF92

Function 00CCF363 Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00CCF8FF

Part of subcall function 00CC050D: __mtinitlocknum.LIBCMT ref: 00CC051F
Part of subcall function 00CC050D: __amsg_exit.LIBCMT ref: 00CC052B
Part of subcall function 00CC050D: EnterCriticalSection.KERNEL32(?,?,00CC2990,0000000D), ref: 00CC0538

_free.LIBCMT ref: 00CCF925

Part of subcall function 00CBA688: RtlFreeHeap.NTDLL(00000000,00000000,?,00CC2938,00000000,00CC0F5F,00CCE22D,00000000,?,00CBFC97,?,?,00000000), ref: 00CBA69C
Part of subcall function 00CBA688: GetLastError.KERNEL32(00000000,?,00CC2938,00000000,00CC0F5F,00CCE22D,00000000,?,00CBFC97,?,?,00000000,?,?,?,00CC2A32), ref: 00CBA6AE

__lock.LIBCMT ref: 00CCF93E
___removelocaleref.LIBCMT ref: 00CCF94D
___freetlocinfo.LIBCMT ref: 00CCF966
_free.LIBCMT ref: 00CCF979

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: 0fc3f17da3bf8a1d8db4761d29f74c2db7b72135f8653794bbbb7032ac220c44
Instruction ID: 69993d19a0f4769ee7d3a01e2a96355c970977b37950469046bd4651028fc52b
Opcode Fuzzy Hash: 0fc3f17da3bf8a1d8db4761d29f74c2db7b72135f8653794bbbb7032ac220c44
Instruction Fuzzy Hash: 1101C031501305E7DF346F68D802F6D73A19F01736F24063DF069A60D1CB748A82EA95

Function 00C994B0 Relevance: 7.7, APIs: 5, Instructions: 197synchronizationCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,00CF7440,00000104), ref: 00C99599
_memset.LIBCMT ref: 00C9966E
GetTickCount.KERNEL32 ref: 00C996A4
__vfwprintf_p.LIBCMT ref: 00C9975A
ReleaseMutex.KERNEL32(0000010C), ref: 00C99790

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: CountFileModuleMutexNameReleaseTick__vfwprintf_p_memset
String ID:
API String ID: 2753155262-0
Opcode ID: 8abf2d7212fe0b2d8fe8401c0b87caf92749b5f1f3f7d8051f8104e0792929ce
Instruction ID: ad7c3f5d8dde430819c0793821f15b423f11ae7cc3388201b4e0e08d282aaf0c
Opcode Fuzzy Hash: 8abf2d7212fe0b2d8fe8401c0b87caf92749b5f1f3f7d8051f8104e0792929ce
Instruction Fuzzy Hash: C1817DB5D00A48AFCB05CFA9EC82BBDBBB1AF49300F048259EA0577261E7716584DF52

Function 00CAA690 Relevance: 7.6, APIs: 5, Instructions: 120fileCOMMON

Download Yara Rule

APIs

std::ios_base::good.LIBCPMTD ref: 00CAA74F
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00CAA7A2
std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 00CAA7B1
DeleteFileA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00C97A5E), ref: 00CAA7BE
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00CAA828

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: Affinity::operator!=Concurrency::details::Hardware$DeleteFileMutex_baseMutex_base::~_std::_std::ios_base::good
String ID:
API String ID: 1152012751-0
Opcode ID: 5dde9cfde8b36b67d4c6a7479ce639b0dcdf954642fcea9fb0d66cd66ce3d0ed
Instruction ID: fceedf919687b9f7a486eaa516ae3b7edb113c5a3980683d07bffa24364b377a
Opcode Fuzzy Hash: 5dde9cfde8b36b67d4c6a7479ce639b0dcdf954642fcea9fb0d66cd66ce3d0ed
Instruction Fuzzy Hash: EC51B071810909DFCB06EBB6EC917BEB374BF59344B108359E60276171EB306A89EF52

Function 00CE3B77 Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00CE3BB2
_strlen.LIBCMT ref: 00CE3BC0

Part of subcall function 00CC0F5A: __getptd_noexit.LIBCMT ref: 00CC0F5A

_strnlen.LIBCMT ref: 00CE3C4B
__lock.LIBCMT ref: 00CE3C5C
__getenv_helper_nolock.LIBCMT ref: 00CE3C67

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: 0c11a58733143c47b559e5a2c6edbdef64f7f6a0e7661974b1174312d560fc57
Instruction ID: 570a474d9062af27b4d0389a8856ded66e42911ff32b8cebde37bac12c4df8a7
Opcode Fuzzy Hash: 0c11a58733143c47b559e5a2c6edbdef64f7f6a0e7661974b1174312d560fc57
Instruction Fuzzy Hash: 8D3100326042D6ABDB216B66DC06B6F77546F01720F310169F919DB281DB74EB0167E1

Function 00CCE0FD Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00CCE109

Part of subcall function 00CBA6FD: __FF_MSGBANNER.LIBCMT ref: 00CBA714
Part of subcall function 00CBA6FD: __NMSG_WRITE.LIBCMT ref: 00CBA71B
Part of subcall function 00CBA6FD: RtlAllocateHeap.NTDLL(014A0000,00000000,00000001,00000000,00000000,00000000,?,00CBFCE1,00000000,00000000,00000000,00000000,?,00CC05F7,00000018,00CF3E08), ref: 00CBA740

_free.LIBCMT ref: 00CCE11C

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: b1a3419d4593e0e7b2010ed763d28b8847b42ef8c37e17feb7e436a032f0e273
Instruction ID: bfa8a367adeff553221e5513bf4b30509d00f660a9dea8afd894e054df04f396
Opcode Fuzzy Hash: b1a3419d4593e0e7b2010ed763d28b8847b42ef8c37e17feb7e436a032f0e273
Instruction Fuzzy Hash: CE11EC32508215AFCB316FB5EC05FAD37949F05360F28452DF9699A152DA348AE0E791

Function 00C99D40 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00C99DBA
CreateThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00C99DD5
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00001000), ref: 00C99DE2
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00C99DF0
CloseHandle.KERNEL32(00000000,?,000000FF), ref: 00C99DFC

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: ae8488fa3e909d6775a7ddc872a2e0212a211ed159daafe4c8dde3c14c6e1a83
Instruction ID: 8bd7b5a645443604ec8c856e80448e0f779ea700a9378e64efe99c39aa410965
Opcode Fuzzy Hash: ae8488fa3e909d6775a7ddc872a2e0212a211ed159daafe4c8dde3c14c6e1a83
Instruction Fuzzy Hash: A921F775A00608EFC705CFA5DD86B6DBBB5FB49301F208645FA05AB3A0DB70AA84DF51

Function 00C9D7B0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 307COMMON

Download Yara Rule

APIs

__snprintf.LIBCMT ref: 00C9D8D3
_memset.LIBCMT ref: 00C9D906
_memset.LIBCMT ref: 00C9DD04

Strings

C:\Windows\system32\config\systemprofile, xrefs: 00C9D90E

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: _memset$__snprintf
String ID: C:\Windows\system32\config\systemprofile
API String ID: 1922369481-3771762618
Opcode ID: 462e03664501d3bcd519287bd2aa1fa18361f3a0e170d809f5d62146c977a2a2
Instruction ID: 50a17d37d416bfc6e6c4cf49d7ba38dd7fffaa94e2d96615d30329b735291e6f
Opcode Fuzzy Hash: 462e03664501d3bcd519287bd2aa1fa18361f3a0e170d809f5d62146c977a2a2
Instruction Fuzzy Hash: 3FD1AD72810E089EC706EFB4EC92BBDB734BF55744F108319E3067A1A2EB706589DB52

Function 00CCF2F6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 00CCF309

Strings

U, xrefs: 00CCF312

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: 58f4dcfdeb46a1ef76eb26970e2e90d49b09997028af806836dc1b63f1c3b21b
Instruction ID: 217663d2c82e71265e749012b6403fa3b79d0aa1282fcf504c250acb80bf1f45
Opcode Fuzzy Hash: 58f4dcfdeb46a1ef76eb26970e2e90d49b09997028af806836dc1b63f1c3b21b
Instruction Fuzzy Hash: D221D8326082087BEB00DF64EC45FBE73EDDB45760F24017DFA18C6190FA61DE429694

Function 00CDE5FE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00CDE615
_wcscmp.LIBCMT ref: 00CDE626

Strings

ACP, xrefs: 00CDE60F
OCP, xrefs: 00CDE620

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: _wcscmp
String ID: ACP$OCP
API String ID: 856254489-711371036
Opcode ID: 52ac382d6ca71a91db7390e3cc90ac72784dc52b99c425aaed19d7869d816214
Instruction ID: 4b5ac7e5d67948ef85faca17973e2e5e01c20b93cc4b78f8f42be43dcccf4ebf
Opcode Fuzzy Hash: 52ac382d6ca71a91db7390e3cc90ac72784dc52b99c425aaed19d7869d816214
Instruction Fuzzy Hash: 8601963130124D76EB60BA59DC46FDA339C9F21354F044467FB15DE282E770E74196DA

Function 00CB5D20 Relevance: 6.3, APIs: 4, Instructions: 252COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00CB5F63
_malloc.LIBCMT ref: 00CB5FB4

Part of subcall function 00CBA6FD: __FF_MSGBANNER.LIBCMT ref: 00CBA714
Part of subcall function 00CBA6FD: __NMSG_WRITE.LIBCMT ref: 00CBA71B
Part of subcall function 00CBA6FD: RtlAllocateHeap.NTDLL(014A0000,00000000,00000001,00000000,00000000,00000000,?,00CBFCE1,00000000,00000000,00000000,00000000,?,00CC05F7,00000018,00CF3E08), ref: 00CBA740

_memset.LIBCMT ref: 00CB60D6
_free.LIBCMT ref: 00CB60E4

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: _malloc$AllocateHeap_free_memset
String ID:
API String ID: 3974598690-0
Opcode ID: 1f07792726be09adb580e4d4ac075911fc2b0ba972f137f494d92e3d650b2ace
Instruction ID: 5d0b2c556f022b61d12e336c5849b5ebc28aa5216a1045237da129049941e4f5
Opcode Fuzzy Hash: 1f07792726be09adb580e4d4ac075911fc2b0ba972f137f494d92e3d650b2ace
Instruction Fuzzy Hash: 27C15971900E489FC705CF69E8807BDBBB1FF99344B14C209EB056B265EB31A584CF86

Function 00CCD34E Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00CCD3DF
_memmove.LIBCMT ref: 00CCD453
___AdjustPointer.LIBCMT ref: 00CCD4A4
_memmove.LIBCMT ref: 00CCD4AD

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: AdjustPointer_memmove
String ID:
API String ID: 1721217611-0
Opcode ID: 0af1d04e2d7d7afc8bac0e948ec681327afb6abf962d11d64285464d4051001a
Instruction ID: 1bd5f8ead525b008e58f80737d0834a64ac4471f8d1ffc423bfe71bd78d55ea0
Opcode Fuzzy Hash: 0af1d04e2d7d7afc8bac0e948ec681327afb6abf962d11d64285464d4051001a
Instruction Fuzzy Hash: 8F4186352047439BEB399F15E881F6A77E49F41710F24403EFA528A6E2EB71FA81D711

Function 00CD2AF4 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00CD2B2A
__isleadbyte_l.LIBCMT ref: 00CD2B58
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,00C922CC,E1C11FE1,00BFBBEF,00000000,?,00000000,00000000,?,00CD1629,00C922CC,00BFBBEF,00000003), ref: 00CD2B86
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,00C922CC,00000001,00BFBBEF,00000000,?,00000000,00000000,?,00CD1629,00C922CC,00BFBBEF,00000003), ref: 00CD2BBC

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: d4c64ea6e2ac04721762b42efcabbe26e23406e9a54fe21fa9d12cb95c69830c
Instruction ID: dbc08c94c5ce1f378dd015aac33de71c6bb06a7161e398d49160274159d1db5f
Opcode Fuzzy Hash: d4c64ea6e2ac04721762b42efcabbe26e23406e9a54fe21fa9d12cb95c69830c
Instruction Fuzzy Hash: A731F531604246BFDB228F35CC84BAA7BB5FF51310F15416BE9268B290D7B0D991DB90

Function 00C93D80 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00C93DB2

Part of subcall function 00CBA6FD: __FF_MSGBANNER.LIBCMT ref: 00CBA714
Part of subcall function 00CBA6FD: __NMSG_WRITE.LIBCMT ref: 00CBA71B
Part of subcall function 00CBA6FD: RtlAllocateHeap.NTDLL(014A0000,00000000,00000001,00000000,00000000,00000000,?,00CBFCE1,00000000,00000000,00000000,00000000,?,00CC05F7,00000018,00CF3E08), ref: 00CBA740

_memset.LIBCMT ref: 00C93DDA
_memset.LIBCMT ref: 00C93E25
_free.LIBCMT ref: 00C93E34

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: _memset$AllocateHeap_free_malloc
String ID:
API String ID: 585861054-0
Opcode ID: fe2fcfbbe0dc3c7ffefeda2b0db1036e5f8a9984ee00690cb5f9c1917fd21665
Instruction ID: 6d30f82f8e0d1c0a7a00f9fe4407cf46b51091cbe3e6f5a27b0cbbefce5cf646
Opcode Fuzzy Hash: fe2fcfbbe0dc3c7ffefeda2b0db1036e5f8a9984ee00690cb5f9c1917fd21665
Instruction Fuzzy Hash: DE314AB5900648AFCB05CF28D885BAAB765AF88340F14C758F9095F351D731EE85DB81

Function 00CCF368 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00CC28C0: __getptd_noexit.LIBCMT ref: 00CC28C1
Part of subcall function 00CC28C0: __amsg_exit.LIBCMT ref: 00CC28CE

__calloc_crt.LIBCMT ref: 00CCF9B6

Part of subcall function 00CBFC83: __calloc_impl.LIBCMT ref: 00CBFC92

__lock.LIBCMT ref: 00CCF9EC
___addlocaleref.LIBCMT ref: 00CCF9F8
__lock.LIBCMT ref: 00CCFA0C

Part of subcall function 00CC0F5A: __getptd_noexit.LIBCMT ref: 00CC0F5A

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 876c3ed9c4a23635a3e35212eabf9ffe8e021bd27eae95cfa807f75ec74e3a46
Instruction ID: 662b9533f8675c49610b80af5c6ecbe309ad2f773340022efab9f1123a3450fe
Opcode Fuzzy Hash: 876c3ed9c4a23635a3e35212eabf9ffe8e021bd27eae95cfa807f75ec74e3a46
Instruction Fuzzy Hash: 10019231901301EBD720BFB8C802F5DB7A19F41720F20415DF4999B2C2CA704A42ABA1

Function 00CCB304 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00CCB328

Part of subcall function 00CCBA48: __fltout2.LIBCMT ref: 00CCBA71

__cftog_l.LIBCMT ref: 00CCB34E
__cftoe_l.LIBCMT ref: 00CCB380

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 9b35bf5d01d8104e4e929a5fa51c84b9e4e7bfa3636c240f10ed8a8dd92b8eb4
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 57014E7200018AFBCF125EC4CC06EEE3F66BB19354F598519FA2858031D736CEB1AB92

Function 00CCCBB4 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 00CCCBCB

Part of subcall function 00CCD2C0: ___AdjustPointer.LIBCMT ref: 00CCD309

_UnwindNestedFrames.LIBCMT ref: 00CCCBE2
___FrameUnwindToState.LIBCMT ref: 00CCCBF4
CallCatchBlock.LIBCMT ref: 00CCCC18

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: 2d8c29e931c82cb4b179de0235233341f27f52423f207cbaa2e250d67f1f5fc6
Instruction ID: b8ffd08cb3cf23be2251897f5603827566dba37875a5d3d09f9a1f3d635eef88
Opcode Fuzzy Hash: 2d8c29e931c82cb4b179de0235233341f27f52423f207cbaa2e250d67f1f5fc6
Instruction Fuzzy Hash: 06012932400109BBCF126F95CC41FDA7BBAFF48754F144058F91861121D732E961EBA1

Function 00C9E1E6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00C9E2F6
_memcmp.LIBCMT ref: 00C9E314

Strings

#, xrefs: 00C9E2A3

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: _memcmp
String ID: #
API String ID: 2931989736-1885708031
Opcode ID: 01d9c07a299e25e0638be5d146a627506faf4086c110bb8d041a8cb0bba38310
Instruction ID: d4f44a992fabf1edfdab42d6a843bdf44528a33ddd59478b431ffa7d6b1bfb95
Opcode Fuzzy Hash: 01d9c07a299e25e0638be5d146a627506faf4086c110bb8d041a8cb0bba38310
Instruction Fuzzy Hash: 8831AA71C00E098FCB02CF78E8017ADB776BFAA344F108315E7067A121EB716582DB82

Function 00CA1799 Relevance: 5.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000), ref: 00CA181F
CloseHandle.KERNEL32(00CA56E4), ref: 00CA1829
CloseHandle.KERNEL32(00000020), ref: 00CA1833
CloseHandle.KERNEL32(?), ref: 00CA1843

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 16f5c0befa698df2d448e9d0609b81ddc5db2b06f71ffdefabe8a916755300bf
Instruction ID: 4ac0f1e2bc47841b7ec44134899ca7c827d2b8cb42c6224f482fd21e32c311de
Opcode Fuzzy Hash: 16f5c0befa698df2d448e9d0609b81ddc5db2b06f71ffdefabe8a916755300bf
Instruction Fuzzy Hash: 20F0B775E02209DFCB14DFE1E949BBE7B76AB45305F148948EA21A7290CB3C9940CF91

Function 00CA1766 Relevance: 5.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000), ref: 00CA181F
CloseHandle.KERNEL32(00CA56E4), ref: 00CA1829
CloseHandle.KERNEL32(00000020), ref: 00CA1833
CloseHandle.KERNEL32(?), ref: 00CA1843

Memory Dump Source

Source File: 00000002.00000002.2454696104.0000000000C91000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000002.00000002.2454681111.0000000000C90000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454756784.0000000000CE7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454776498.0000000000CF9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2454805046.0000000000CFA000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c90000_erewpegtq.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 5c64593bb279b0f5e12b225ae2d490ec23f7d3b53544df9af181e6d5fb84861f
Instruction ID: 4ac0f1e2bc47841b7ec44134899ca7c827d2b8cb42c6224f482fd21e32c311de
Opcode Fuzzy Hash: 5c64593bb279b0f5e12b225ae2d490ec23f7d3b53544df9af181e6d5fb84861f
Instruction Fuzzy Hash: 20F0B775E02209DFCB14DFE1E949BBE7B76AB45305F148948EA21A7290CB3C9940CF91

Analysis Process: czmruiag.exePID: 2200, Parent PID: 5772COMMON

Execution Graph

Execution Coverage:	7.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1280
Total number of Limit Nodes:	67

Executed Functions

Function 0019E9C0 Relevance: 268.9, APIs: 150, Strings: 1, Instructions: 4607libraryloadersleepCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0019ECF9
_memset.LIBCMT ref: 0019ED7D
GetModuleHandleA.KERNEL32(?), ref: 0019EF7A
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019F009
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019F0CA
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019F194

Part of subcall function 001A8900: _malloc.LIBCMT ref: 001A897B
Part of subcall function 001A8900: _memmove.LIBCMT ref: 001A8A89

Part of subcall function 00195BB0: _memset.LIBCMT ref: 00195C01
Part of subcall function 00195BB0: _free.LIBCMT ref: 00195C43

GetProcAddress.KERNEL32(74DD0000,?), ref: 0019F2E2
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019F320
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019F35E
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019F39C
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019F3DA
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019F418
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019F47E
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019F4F9
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019F57A
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019F670
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019F6AF
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019F77F
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019F7FC
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019F853
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019F9FD
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019FA3C
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019FA7B
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019FAD8
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019FB4E
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019FBE8
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019FC27
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019FCA7
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019FCE5
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019FD53
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019FD91
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019FDCF
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019FE4A
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019FE89
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019FEC8
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019FF70
GetProcAddress.KERNEL32(74DD0000,?), ref: 0019FFAE
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A0013
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A0051
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A00B9
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A00F7
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A024B
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A028A
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A02D5
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A0314
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A0353
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A03BC
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A041D
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A04E0
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A054B
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A065A
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A0699
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A0790
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A07D9
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A0838
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A0877
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A08E6
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A0925
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A0964
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A09D3
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A0AE9
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A0BD4
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A0C52
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A0CD9
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A0D2B
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A0D6A
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A0E21
GetProcAddress.KERNEL32(74DD0000,?), ref: 001A0EA6
LoadLibraryA.KERNELBASE(?), ref: 001A0EF6
LoadLibraryA.KERNEL32(?), ref: 001A0F92
GetProcAddress.KERNEL32(74D60000,?), ref: 001A0FEE
GetProcAddress.KERNEL32(74D60000,?), ref: 001A102D
GetProcAddress.KERNEL32(74D60000,?), ref: 001A10E2
GetProcAddress.KERNEL32(74D60000,?), ref: 001A1131
GetProcAddress.KERNEL32(74D60000,?), ref: 001A118A
GetProcAddress.KERNEL32(74D60000,?), ref: 001A11C9
GetProcAddress.KERNEL32(74D60000,?), ref: 001A1208
GetProcAddress.KERNEL32(74D60000,?), ref: 001A12B9
GetProcAddress.KERNEL32(74D60000,?), ref: 001A12F8
GetProcAddress.KERNEL32(74D60000,?), ref: 001A14DB
GetProcAddress.KERNEL32(74D60000,?), ref: 001A15E0
GetProcAddress.KERNEL32(74D60000,?), ref: 001A1634
GetProcAddress.KERNEL32(74D60000,?), ref: 001A1673
GetProcAddress.KERNEL32(74D60000,?), ref: 001A16B2
GetProcAddress.KERNEL32(74D60000,?), ref: 001A1730
GetProcAddress.KERNEL32(74D60000,?), ref: 001A176E
GetProcAddress.KERNEL32(74D60000,?), ref: 001A17E5
LoadLibraryA.KERNELBASE(?), ref: 001A18B9
GetProcAddress.KERNEL32(75A70000,?), ref: 001A18F8
GetProcAddress.KERNEL32(75A70000,?), ref: 001A1990
GetProcAddress.KERNEL32(75A70000,?), ref: 001A19CF
GetProcAddress.KERNEL32(75A70000,?), ref: 001A1A26
GetProcAddress.KERNEL32(75A70000,?), ref: 001A1A89
GetProcAddress.KERNEL32(75A70000,?), ref: 001A1AD8
GetProcAddress.KERNEL32(75A70000,?), ref: 001A1B3B
GetProcAddress.KERNEL32(75A70000,?), ref: 001A1BAA
GetProcAddress.KERNEL32(75A70000,?), ref: 001A1C18
GetProcAddress.KERNEL32(75A70000,?), ref: 001A1D36
GetProcAddress.KERNEL32(75A70000,?), ref: 001A1D75
GetProcAddress.KERNEL32(75A70000,?), ref: 001A1DB4
GetProcAddress.KERNEL32(75A70000,?), ref: 001A1DF3
GetProcAddress.KERNEL32(75A70000,?), ref: 001A1E32
GetProcAddress.KERNEL32(75A70000,?), ref: 001A1E89
GetProcAddress.KERNEL32(75A70000,?), ref: 001A1EF0
GetProcAddress.KERNEL32(75A70000,?), ref: 001A1FA7
GetProcAddress.KERNEL32(75A70000,?), ref: 001A201D
GetProcAddress.KERNEL32(75A70000,?), ref: 001A205B
GetProcAddress.KERNEL32(75A70000,?), ref: 001A2118
GetProcAddress.KERNEL32(75A70000,?), ref: 001A2175
GetProcAddress.KERNEL32(75A70000,?), ref: 001A21B4
GetProcAddress.KERNEL32(75A70000,?), ref: 001A21F3
GetProcAddress.KERNEL32(75A70000,?), ref: 001A2232
GetProcAddress.KERNEL32(75A70000,?), ref: 001A2299

Part of subcall function 00187DE0: GetSystemTime.KERNEL32(?,?,?,?,?,?,001874FC), ref: 00187E5C
Part of subcall function 00187DE0: GetTickCount.KERNEL32 ref: 00187EEF

GetEnvironmentVariableA.KERNEL32(?,C:\Windows\system32\config\systemprofile,00000104), ref: 001A233E
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 001A2391
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 001A23AC
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 001A23BD

Part of subcall function 001A94DD: _malloc.LIBCMT ref: 001A94F5

GetTickCount.KERNEL32 ref: 001A2543
__itow.LIBCMT ref: 001A254A

Part of subcall function 0019ACD0: GetVersionExA.KERNEL32(001E6DB8), ref: 0019AD42
Part of subcall function 0019ACD0: CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0019AE1E

__stat32i64.LIBCMT ref: 001A2A37

Part of subcall function 001AA7E0: ___copy_path_to_wide_string.LIBCMT ref: 001AA7F5

Sleep.KERNEL32(00000D05), ref: 001A2A7E
__stat32i64.LIBCMT ref: 001A2A92

Part of subcall function 001AA7E0: __wstat64i32.LIBCMT ref: 001AA80D
Part of subcall function 001AA7E0: _free.LIBCMT ref: 001AA817

Sleep.KERNELBASE(000007D0), ref: 001A2C44
__stat32i64.LIBCMT ref: 001A2C57
GetModuleFileNameA.KERNEL32(00000000,?,00000200), ref: 001A2C8C
SetFileAttributesA.KERNEL32(00000000,00000080), ref: 001A2C9B
CopyFileA.KERNEL32(?,00000000,00000000), ref: 001A2CE0
SetFileAttributesA.KERNEL32(00000000,00000002), ref: 001A2F2B
SetFileAttributesA.KERNEL32(00000000,00000080), ref: 001A2F3C
Sleep.KERNELBASE(000003E8), ref: 001A302E
GetCommandLineA.KERNEL32 ref: 001A3071
GetModuleFileNameA.KERNEL32(00000000,00000000,00000200), ref: 001A313E
LoadLibraryA.KERNEL32(?), ref: 001A3379
GetProcAddress.KERNEL32(?,?), ref: 001A33B9
WSAStartup.WS2_32(00000202,?), ref: 001A3912

Part of subcall function 00191CE0: _strstr.LIBCMT ref: 00191CEB

CloseHandle.KERNEL32(00000000), ref: 001A3AA1
SetFileAttributesA.KERNEL32(?,00000080), ref: 001A3AB3
CopyFileA.KERNEL32(00000000,?,00000000), ref: 001A3AC9
SetFileAttributesA.KERNEL32(?,00000002), ref: 001A3AE0
Sleep.KERNEL32(000003E8), ref: 001A3B3C

Part of subcall function 00194900: _memset.LIBCMT ref: 00194A25

Sleep.KERNEL32(000007D0), ref: 001A3BD1

Part of subcall function 001AAE47: __fsopen.LIBCMT ref: 001AAE52

Part of subcall function 00182240: Sleep.KERNEL32(000003E8), ref: 001822FA

SetFileAttributesA.KERNEL32(001E7090,00000080), ref: 001A3BE3
CopyFileA.KERNEL32(00000000,001E7090,00000000), ref: 001A3BF7
SetFileAttributesA.KERNEL32(001E7090,00000002), ref: 001A3C44

Part of subcall function 00196E60: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00196EEE
Part of subcall function 00196E60: Process32First.KERNEL32(00000000,00000128), ref: 00196F71

__snprintf.LIBCMT ref: 001A3E23
_memset.LIBCMT ref: 001A3EF4
_memset.LIBCMT ref: 001A3F0A
CreateThread.KERNEL32(00000000,00000000,Function_00007390,00000000,00000000,00000000), ref: 001A3F21
Sleep.KERNEL32(0000C350), ref: 001A3F63
GetCommandLineA.KERNEL32 ref: 001A263F

Part of subcall function 001AA5B0: _doexit.LIBCMT ref: 001AA5BA

Strings

C:\Windows\system32\config\systemprofile, xrefs: 001A2332

Memory Dump Source

Source File: 00000003.00000002.2475403570.0000000000181000.00000020.00000001.01000000.00000007.sdmp, Offset: 00180000, based on PE: true

Associated: 00000003.00000002.2475354111.0000000000180000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475473087.00000000001D7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475531770.00000000001E5000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475531770.00000000001E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475570182.00000000001EA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000_czmruiag.jbxd

Similarity

API ID: AddressProc$File$AttributesSleep$Create$_memset$LibraryLoad$CopyModuleMutex__stat32i64_malloc$CommandCountHandleLineNameTick_free$CloseDirectoryEnvironmentFirstProcess32SnapshotStartupSystemThreadTimeToolhelp32VariableVersion___copy_path_to_wide_string__fsopen__itow__snprintf__wstat64i32_doexit_memmove_strstr
String ID: C:\Windows\system32\config\systemprofile
API String ID: 2795360046-3771762618
Opcode ID: 6e0af0354e7a41cfe68f36e2c2efcc260b49f13cf790f437b0c2746258b12cb2
Instruction ID: 21228cd033c929b19108d7b8606ccb9a69c48225185033329c17a05c42c54960
Opcode Fuzzy Hash: 6e0af0354e7a41cfe68f36e2c2efcc260b49f13cf790f437b0c2746258b12cb2
Instruction Fuzzy Hash: 49A3BF75D01A888FC712CFB4EC81B6DB776BF9A349F448249E5097AAA1EB7019C0CF51

Function 00194360 Relevance: 6.1, APIs: 4, Instructions: 121
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00181DA0: WaitForSingleObject.KERNEL32(00000104,00004E20,?,?,?,?,0019686C,00000104), ref: 00181EBC

CreateFileA.KERNELBASE(00000002,40000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00194409

Part of subcall function 00186DF0: ReleaseMutex.KERNEL32(00196B5F,?,00196B5F,00000104), ref: 00186E07

Memory Dump Source

Source File: 00000003.00000002.2475403570.0000000000181000.00000020.00000001.01000000.00000007.sdmp, Offset: 00180000, based on PE: true

Associated: 00000003.00000002.2475354111.0000000000180000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475473087.00000000001D7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475531770.00000000001E5000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475531770.00000000001E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475570182.00000000001EA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000_czmruiag.jbxd

Similarity

API ID: CreateFileMutexObjectReleaseSingleWait
String ID:
API String ID: 1564016613-0
Opcode ID: a47c6e0bf202d9afe9eed79385ae6c31aa835a754eb338c7878ce6acd08b9b43
Instruction ID: 5d38f12693901ea311ddb7fffd579dd3900a516f21a3835fae49965fb9636557
Opcode Fuzzy Hash: a47c6e0bf202d9afe9eed79385ae6c31aa835a754eb338c7878ce6acd08b9b43
Instruction Fuzzy Hash: 7D519C75800A88EFCB05CFE5EC81B5EB375BB98344F108619F5066B6A1E7706AC0CF90

Function 0018A200 Relevance: 4.6, APIs: 3, Instructions: 123
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0018A311
CheckTokenMembership.ADVAPI32(00000000,?,00000000), ref: 0018A349
FreeSid.ADVAPI32(?), ref: 0018A42F

Memory Dump Source

Source File: 00000003.00000002.2475403570.0000000000181000.00000020.00000001.01000000.00000007.sdmp, Offset: 00180000, based on PE: true

Associated: 00000003.00000002.2475354111.0000000000180000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475473087.00000000001D7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475531770.00000000001E5000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475531770.00000000001E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475570182.00000000001EA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000_czmruiag.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: ef98860262b573208cdfd87b05031623de0a3786045c65020cefbdbfb902d211
Instruction ID: de48b5bc7925144c5e5f5f931acb87e25736ec6aa850503d67278461da102e02
Opcode Fuzzy Hash: ef98860262b573208cdfd87b05031623de0a3786045c65020cefbdbfb902d211
Instruction Fuzzy Hash: 19517871801E89CEC706CFF9E89035EB376BF9A388F54830AE5067E961EBB051C18B51

Function 001A94DD Relevance: 4.5, APIs: 3, Instructions: 29
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 001A94F5

Part of subcall function 001AA6FD: __FF_MSGBANNER.LIBCMT ref: 001AA714
Part of subcall function 001AA6FD: __NMSG_WRITE.LIBCMT ref: 001AA71B
Part of subcall function 001AA6FD: RtlAllocateHeap.NTDLL(00AF0000,00000000,00000001,00000000,00000000,00000000,?,001AFCE1,00000000,00000000,00000000,00000000,?,001B05F7,00000018,001E3E08), ref: 001AA740

std::exception::exception.LIBCMT ref: 001A9513
__CxxThrowException@8.LIBCMT ref: 001A9528

Part of subcall function 001AF37C: RaiseException.KERNEL32(?,?,?,001E3AD0,?,?,?,?,?,001A952D,?,001E3AD0,00000000,00000001), ref: 001AF3D1

Memory Dump Source

Source File: 00000003.00000002.2475403570.0000000000181000.00000020.00000001.01000000.00000007.sdmp, Offset: 00180000, based on PE: true

Associated: 00000003.00000002.2475354111.0000000000180000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475473087.00000000001D7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475531770.00000000001E5000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475531770.00000000001E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475570182.00000000001EA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000_czmruiag.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID:
API String ID: 3074076210-0
Opcode ID: 05607002c6adc5a7a2714bff9a2669168c9ea4997921a026c501ca671e729544
Instruction ID: 068fde520966fa3999c90fc64df0fbc17678afb9cf9799ca7467b6bc4f20d4f6
Opcode Fuzzy Hash: 05607002c6adc5a7a2714bff9a2669168c9ea4997921a026c501ca671e729544
Instruction Fuzzy Hash: 0DE0657890020EABCF10EFA5DD069EE776CEF16314F504467E814A6281DF70DB95D991

Function 001BE043 Relevance: 3.0, APIs: 2, Instructions: 30
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,?,?,?,?,5EFC4D8B,00000000,00000000,00000000,?,001BEAA4,?,?,00000000,?,00000000), ref: 001BE06A
LCMapStringW.KERNEL32(00000000,?,?,?,?,5EFC4D8B,?,001BEAA4,?,?,00000000,?,00000000,00000000), ref: 001BE087

Memory Dump Source

Source File: 00000003.00000002.2475403570.0000000000181000.00000020.00000001.01000000.00000007.sdmp, Offset: 00180000, based on PE: true

Associated: 00000003.00000002.2475354111.0000000000180000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475473087.00000000001D7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475531770.00000000001E5000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475531770.00000000001E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475570182.00000000001EA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000_czmruiag.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: e7e46de0a6714c035316f3a435b2a741ea382b2ce5cb18581d3c7a9236ac4b2f
Instruction ID: 1f3d0cbafe5ac68d7bebafb15f96e6dd7517b962ca282a02267432482d59aee9
Opcode Fuzzy Hash: e7e46de0a6714c035316f3a435b2a741ea382b2ce5cb18581d3c7a9236ac4b2f
Instruction Fuzzy Hash: 37F01F72010249FFDF069FD4EC4ACEE3F6AFB58350B148515FA1949420E772E9B2AB90

Function 001CF430 Relevance: 3.0, APIs: 2, Instructions: 17
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 001CF447

Part of subcall function 001B050D: __mtinitlocknum.LIBCMT ref: 001B051F
Part of subcall function 001B050D: __amsg_exit.LIBCMT ref: 001B052B
Part of subcall function 001B050D: EnterCriticalSection.KERNEL32(?,?,001B2990,0000000D), ref: 001B0538

__tzset_nolock.LIBCMT ref: 001CF45A

Part of subcall function 001CF713: __lock.LIBCMT ref: 001CF738
Part of subcall function 001CF713: ____lc_codepage_func.LIBCMT ref: 001CF77F
Part of subcall function 001CF713: __getenv_helper_nolock.LIBCMT ref: 001CF7A0
Part of subcall function 001CF713: _free.LIBCMT ref: 001CF7D3
Part of subcall function 001CF713: _strlen.LIBCMT ref: 001CF7DA
Part of subcall function 001CF713: __malloc_crt.LIBCMT ref: 001CF7E1

Memory Dump Source

Source File: 00000003.00000002.2475403570.0000000000181000.00000020.00000001.01000000.00000007.sdmp, Offset: 00180000, based on PE: true

Associated: 00000003.00000002.2475354111.0000000000180000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475473087.00000000001D7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475531770.00000000001E5000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475531770.00000000001E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475570182.00000000001EA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000_czmruiag.jbxd

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 3edb0a391de38a3ac41579a83747f5104da33a09aa3c87dc54de89862c606766
Instruction ID: 7ad4f3008932d70f850abb7d337637a8f26b5d759cd03acd7a1b8cc0119309a6
Opcode Fuzzy Hash: 3edb0a391de38a3ac41579a83747f5104da33a09aa3c87dc54de89862c606766
Instruction Fuzzy Hash: F1E0C234441384DADB70BFF0AA4BB0E3121BB30B26F60416DE058055D28FF485C6CB13

Function 001AA17E Relevance: 3.0, APIs: 2, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 001AA184

Part of subcall function 001AA14A: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,001AA189,00000000,?,001AA72A,000000FF,0000001E,00000000,00000000,00000000,?,001AFCE1), ref: 001AA159
Part of subcall function 001AA14A: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 001AA16B

ExitProcess.KERNEL32 ref: 001AA18D

Memory Dump Source

Source File: 00000003.00000002.2475403570.0000000000181000.00000020.00000001.01000000.00000007.sdmp, Offset: 00180000, based on PE: true

Associated: 00000003.00000002.2475354111.0000000000180000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475473087.00000000001D7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475531770.00000000001E5000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475531770.00000000001E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475570182.00000000001EA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000_czmruiag.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: d08aff761204e43bdbe5a1a516ea51eeacafbe3c57684c618e71b36c59a7a1a1
Instruction ID: e30cf74f32f83d422267cf7cb98f2d9523a41d8e7e9caf5636a05f30b854e59b
Opcode Fuzzy Hash: d08aff761204e43bdbe5a1a516ea51eeacafbe3c57684c618e71b36c59a7a1a1
Instruction Fuzzy Hash: DDB09230005108BBCB012F15EC0A8483F29EF022A0B404021F908480B2EB72A9D1AA92

Function 00192280 Relevance: 2.8, APIs: 1, Instructions: 1305
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00193AAC

Memory Dump Source

Source File: 00000003.00000002.2475403570.0000000000181000.00000020.00000001.01000000.00000007.sdmp, Offset: 00180000, based on PE: true

Associated: 00000003.00000002.2475354111.0000000000180000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475473087.00000000001D7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475531770.00000000001E5000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475531770.00000000001E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475570182.00000000001EA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000_czmruiag.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 6ec637da9029f2589413d1fd197bdbfd480a0cf61a1ac2c5721290220227fb64
Instruction ID: 5b4853c5fbd06872912913ed1d63a8a929d14a08e103d80e892840c72aef1131
Opcode Fuzzy Hash: 6ec637da9029f2589413d1fd197bdbfd480a0cf61a1ac2c5721290220227fb64
Instruction Fuzzy Hash: EEF21671811E89CEC306CFB9E9D122DB7B7BF9A389354830AE5067EA61EB7050C1DB54

Function 001AA5B0 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 001AA5BA

Part of subcall function 001AA481: __lock.LIBCMT ref: 001AA48F
Part of subcall function 001AA481: DecodePointer.KERNEL32(001E3D00,0000001C,001AA36E,00000000,00000001,00000000,?,001AA2BC,000000FF,?,001B0530,00000011,?,?,001B2990,0000000D), ref: 001AA4CE
Part of subcall function 001AA481: DecodePointer.KERNEL32(?,001AA2BC,000000FF,?,001B0530,00000011,?,?,001B2990,0000000D), ref: 001AA4DF
Part of subcall function 001AA481: EncodePointer.KERNEL32(00000000,?,001AA2BC,000000FF,?,001B0530,00000011,?,?,001B2990,0000000D), ref: 001AA4F8
Part of subcall function 001AA481: DecodePointer.KERNEL32(-00000004,?,001AA2BC,000000FF,?,001B0530,00000011,?,?,001B2990,0000000D), ref: 001AA508
Part of subcall function 001AA481: EncodePointer.KERNEL32(00000000,?,001AA2BC,000000FF,?,001B0530,00000011,?,?,001B2990,0000000D), ref: 001AA50E
Part of subcall function 001AA481: DecodePointer.KERNEL32(?,001AA2BC,000000FF,?,001B0530,00000011,?,?,001B2990,0000000D), ref: 001AA524
Part of subcall function 001AA481: DecodePointer.KERNEL32(?,001AA2BC,000000FF,?,001B0530,00000011,?,?,001B2990,0000000D), ref: 001AA52F

Memory Dump Source

Source File: 00000003.00000002.2475403570.0000000000181000.00000020.00000001.01000000.00000007.sdmp, Offset: 00180000, based on PE: true

Associated: 00000003.00000002.2475354111.0000000000180000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475473087.00000000001D7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475531770.00000000001E5000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475531770.00000000001E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2475570182.00000000001EA000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000_czmruiag.jbxd

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: 5e71871f24a1e84c1ef684760a81b4af5d59bf23fdb1a975e169de1a5fd5e46f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: 5BB0123198030C33D9112545FC03F553B0C4B55B54F940021FA0C1C1E1B7D37560C0CA

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 25XrVZw56S.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\bamqdjw\txadnumgtelp

C:\bamqdjw\czmruiag.exe

C:\bamqdjw\erewpegtq.exe

C:\bamqdjw\mt2o4nrsazl5davsv.exe

C:\bamqdjw\txadnumgtelp

C:\bamqdjw\y7sukma

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
25XrVZw56S.exe

Function 00FCACD0 Relevance: 30.7, APIs: 15, Strings: 2, Instructions: 936
fileCOMMON

Function 00FC0E80 Relevance: 9.3, APIs: 6, Instructions: 286
sleepCOMMON

Function 00FBA200 Relevance: 4.6, APIs: 3, Instructions: 123
memoryCOMMON

Function 00FDEEA4 Relevance: 24.1, APIs: 16, Instructions: 89
COMMON

Function 00FB8E40 Relevance: 12.3, APIs: 8, Instructions: 271
fileCOMMON

Function 00FC7E90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70
processCOMMON

Function 00FC2280 Relevance: 4.8, APIs: 1, Strings: 1, Instructions: 1305
COMMON

Function 00FC4360 Relevance: 4.6, APIs: 3, Instructions: 121
fileCOMMON

Function 00FD94DD Relevance: 4.5, APIs: 3, Instructions: 29
COMMONLIBRARYCODE

Function 00FEE043 Relevance: 3.0, APIs: 2, Instructions: 30
COMMONLIBRARYCODE

Function 00FDA17E Relevance: 3.0, APIs: 2, Instructions: 7
COMMONLIBRARYCODE

Function 00FCA370 Relevance: 1.5, APIs: 1, Instructions: 38
COMMON

Function 00FDA5B0 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre