Edit tour

Windows Analysis Report
2Wr5r2e9vo.msi

Overview

General Information

Sample name:	2Wr5r2e9vo.msi renamed because original name is a hash value
Original sample name:	8ef787b0f11fcb0d5d9fe3b209bb5526.msi
Analysis ID:	1562073
MD5:	8ef787b0f11fcb0d5d9fe3b209bb5526
SHA1:	e5f31bfe6f080679807333760f18281abfd17adc
SHA256:	d66bdcb1c0a4f2e5452c852e24e001d153a9c9de1d7a692cb5f1ede5e056f1fa
Tags:	msiuser-abuse_ch
Infos:

Detection

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Found API chain indicative of debugger detection

Performs DNS queries to domains with low reputation

Tries to resolve many domain names, but no domain seems valid

Checks for available system drives (often done to infect USB drives)

Connects to many different domains

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Executes massive DNS lookups (> 100)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 4364 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\2Wr5r2e9vo.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 2536 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 4196 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding C87318A1E88CD27EAD404D332FBFE39C MD5: 9D09DC1EDA745A5F87553048E57620CF)

icacls.exe (PID: 1020 cmdline: "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\." /SETINTEGRITYLEVEL (CI)(OI)HIGH MD5: 2E49585E4E08565F52090B144062F97E)

conhost.exe (PID: 4440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

expand.exe (PID: 6628 cmdline: "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files MD5: 544B0DBFF3F393BCE8BB9D815F532D51)

conhost.exe (PID: 4616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

anterra.exe (PID: 5588 cmdline: "C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe" /VERYSILENT /VERYSILENT MD5: DF5B588DABBB47648D6FEF8ABBC59064)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://keoqiqigggqkcykq.xyz:443/api/client_hello

Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: keoqiqigggqkcykq.xyz	Virustotal: Detection: 12%			Perma Link
Source: oqsakkimkesccikc.xyz	Virustotal: Detection: 5%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\4244ba815cc94a57841dfebadb3b6b17$dpx$.tmp\8cccbf84c3e089418139dd95981f2766.tmp	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe (copy)	ReversingLabs: Detection: 31%

Multi AV Scanner detection for submitted file

Source: 2Wr5r2e9vo.msi	Virustotal: Detection: 28%			Perma Link
Source: 2Wr5r2e9vo.msi	ReversingLabs: Detection: 29%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.2% probability

Source:

Binary string: C:\ss2\Projects\MsiWrapper\MsiCustomActions\Release\MsiCustomActions.pdb source: 2Wr5r2e9vo.msi, 3a9a03.msi.2.dr, MSI9DBC.tmp.2.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005C239E _free,_free,FindFirstFileExW,_free,		13_2_005C239E
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005C244F FindFirstFileExW,_free,FindNextFileW,_free,FindClose,_free,		13_2_005C244F

Networking

Performs DNS queries to domains with low reputation

Source:	DNS query: qckwwsmukogkeuge.xyz
Source:	DNS query: keoqiqigggqkcykq.xyz
Source:	DNS query: kqsamcsauqiagmma.xyz
Source:	DNS query: mocikyoeikocwkuc.xyz
Source:	DNS query: uymiagmwmqmimewm.xyz
Source:	DNS query: gcikuiqswcgsscog.xyz
Source:	DNS query: qwmaokcmiwuqqyes.xyz
Source:	DNS query: igaiseoqksuoukqg.xyz
Source:	DNS query: kqukwaogqoucsaas.xyz
Source:	DNS query: miacggmycyqikoyq.xyz
Source:	DNS query: woceumwmwioocusa.xyz
Source:	DNS query: acgcaiyykiigugms.xyz
Source:	DNS query: cogsyycsuwoysugi.xyz
Source:	DNS query: oekyamueeiiousia.xyz
Source:	DNS query: wukaqiusicksuguo.xyz
Source:	DNS query: yyusosuyycoeikgo.xyz
Source:	DNS query: kqoceoymymoicqky.xyz
Source:	DNS query: uykkwkqqemamguwa.xyz
Source:	DNS query: oyekqyccewougasu.xyz
Source:	DNS query: ymsaymyugccysmow.xyz
Source:	DNS query: omuquowgiusiesgk.xyz
Source:	DNS query: wiywykakusaygisc.xyz
Source:	DNS query: aqmqywkwsmmayyoi.xyz
Source:	DNS query: cuccygameukkeumw.xyz
Source:	DNS query: ukekykoqskumoikg.xyz
Source:	DNS query: uyqcacmsiquuwggq.xyz
Source:	DNS query: ysoqqwckkqssyigm.xyz
Source:	DNS query: yyemsyoimicqmais.xyz
Source:	DNS query: miigookwguakmkeu.xyz
Source:	DNS query: qiuswcgwaqgemwcg.xyz
Source:	DNS query: wuusiiukmwcmimyk.xyz
Source:	DNS query: uqyukkamycuaimsu.xyz
Source:	DNS query: woeamasicuiqyckq.xyz
Source:	DNS query: akaueuwoocwkkoya.xyz
Source:	DNS query: qciqgoeogwwmwkcw.xyz
Source:	DNS query: ucwesqiquqggymqe.xyz
Source:	DNS query: mgseamqmgkqcuewy.xyz
Source:	DNS query: gaoweoyqcuuykwgu.xyz
Source:	DNS query: oqegmuqkgyaywwmc.xyz
Source:	DNS query: qusmiuqmmgqsgeci.xyz
Source:	DNS query: yqcakkmwigkaumii.xyz
Source:	DNS query: qokykyyigsyqggqe.xyz
Source:	DNS query: cyyyokugycioysok.xyz
Source:	DNS query: iqcaysimoeeqamky.xyz
Source:	DNS query: yekiwquqaacesqqq.xyz
Source:	DNS query: gmooqswyuuqaiomi.xyz
Source:	DNS query: kuiomoiwauwckqeq.xyz
Source:	DNS query: ceucuuwiwwuiweaq.xyz
Source:	DNS query: cycscsqyqkeaykgc.xyz
Source:	DNS query: ssagiiaauyewiswa.xyz
Source:	DNS query: ggwsuoyyioagegkw.xyz
Source:	DNS query: ieikmuieoqqmugwu.xyz
Source:	DNS query: kcqkucqkogqiuukw.xyz
Source:	DNS query: oqouwceoowyiwgag.xyz
Source:	DNS query: gakowseyscmeqkya.xyz
Source:	DNS query: quisoakcuqsygyyc.xyz
Source:	DNS query: auuisqaykqgeesae.xyz
Source:	DNS query: iyawyckqggkwsyoq.xyz
Source:	DNS query: ecmyomcaicqysoqw.xyz
Source:	DNS query: iqcqqquiwomgsmma.xyz
Source:	DNS query: ssegwgieumyoasym.xyz
Source:	DNS query: ceeomiecgymecgau.xyz
Source:	DNS query: myisokqwsmqeusuy.xyz
Source:	DNS query: ywkamsiogkycyosy.xyz
Source:	DNS query: ggkyecqguqkkuoso.xyz
Source:	DNS query: kcyoeiykekuqkkmg.xyz
Source:	DNS query: ikwyuqgsegcgcccg.xyz
Source:	DNS query: wgswkwaesqqwkoaa.xyz
Source:	DNS query: eqkkkcuwkiqiecac.xyz
Source:	DNS query: kigcewceemkckeow.xyz
Source:	DNS query: ykaimcgigakggwec.xyz
Source:	DNS query: uceaygkekiassamu.xyz
Source:	DNS query: seioywksogeseqig.xyz
Source:	DNS query: ssoqscyewimqiqme.xyz
Source:	DNS query: kocgeaeoakgqewog.xyz
Source:	DNS query: kuiqsugkqeoscguo.xyz
Source:	DNS query: kcsqwmkusesaccwa.xyz
Source:	DNS query: ywyawywiuyecuiuu.xyz
Source:	DNS query: uowowiqiyeiuwmcc.xyz
Source:	DNS query: uokqeaieowiogsgc.xyz
Source:	DNS query: ikoqkscwsowwukmi.xyz
Source:	DNS query: iymukyseoieqccac.xyz
Source:	DNS query: qascmswkaisogoaq.xyz
Source:	DNS query: gacgceaygaecuguy.xyz
Source:	DNS query: eqyyguuwsyqaqgsq.xyz
Source:	DNS query: ewywcoeukaoaegci.xyz
Source:	DNS query: mmygsewuukqkiiok.xyz
Source:	DNS query: wgyimykogekgewoa.xyz
Source:	DNS query: uiguoqqagkiuagyc.xyz
Source:	DNS query: kcesagqugouwkqyg.xyz
Source:	DNS query: yqeugeoquqsokgqk.xyz
Source:	DNS query: eigkgwkyuqssgamw.xyz
Source:	DNS query: waqmyueimmyiuawq.xyz
Source:	DNS query: qgukewuuykmmkgeq.xyz
Source:	DNS query: gmwcscokucowyogs.xyz
Source:	DNS query: ywegqamoegumacgi.xyz
Source:	DNS query: yquocucuqoywwcsu.xyz
Source:	DNS query: eqmeimmouegoasay.xyz
Source:	DNS query: cykgmsqcgysgaioo.xyz
Source:	DNS query: oqoemaogyoikomiy.xyz
Source:	DNS query: qoiiomimuoaqgeku.xyz
Source:	DNS query: wgymkeismmiemsqq.xyz
Source:	DNS query: ykocagogmeiwmymy.xyz
Source:	DNS query: csoqiicgaaiyyoom.xyz
Source:	DNS query: koioiiwouukqousy.xyz
Source:	DNS query: okkyekwuommcicqi.xyz
Source:	DNS query: ecacmycegqoaquio.xyz
Source:	DNS query: skgcsksqyekiymii.xyz
Source:	DNS query: kckcekceqgcyqcsa.xyz
Source:	DNS query: uoaeyoycyycqkoci.xyz
Source:	DNS query: wsaekoiomeagsaes.xyz
Source:	DNS query: iqmeccigieosgmwq.xyz
Source:	DNS query: ggeqowwmmmeekigg.xyz
Source:	DNS query: sssawsmmkmuyqsaq.xyz
Source:	DNS query: ecmckkeyoskcigeu.xyz
Source:	DNS query: quoqoooiamqkkosc.xyz
Source:	DNS query: waokmuyyeooamowm.xyz
Source:	DNS query: ykomskascimimomo.xyz
Source:	DNS query: mmisquwegymayaee.xyz
Source:	DNS query: mmyukmsqamgicqai.xyz
Source:	DNS query: ikwyooieywakeqog.xyz
Source:	DNS query: mgwmkyyqckeewgce.xyz
Source:	DNS query: owoksuegymmgesys.xyz
Source:	DNS query: aamuskacaaiycguu.xyz
Source:	DNS query: yegskieoocgoamyi.xyz
Source:	DNS query: aaiouwywwcwuuasm.xyz
Source:	DNS query: kuoqgwooymgsqaum.xyz
Source:	DNS query: myoyccuwcyaygceg.xyz
Source:	DNS query: ggqgwuaseamkyywa.xyz
Source:	DNS query: uwimwwicgcscuoku.xyz
Source:	DNS query: cyyukyomsoiqyyqa.xyz
Source:	DNS query: gaisoawuoicqsumy.xyz
Source:	DNS query: qogsmcecyusiyaim.xyz
Source:	DNS query: ykqocceawkwoagmc.xyz
Source:	DNS query: aosywgkogcissggi.xyz
Source:	DNS query: ieywwkeuouoqgqms.xyz
Source:	DNS query: ecgkeyeueawgcuqo.xyz
Source:	DNS query: guimuaoiecmouigq.xyz
Source:	DNS query: ggkyuooyikmqoscw.xyz
Source:	DNS query: uoeeuiaewmogugeo.xyz
Source:	DNS query: okgeqaswygsgykme.xyz
Source:	DNS query: ywqiciegywcouoiy.xyz
Source:	DNS query: qgkgogieieoomkqq.xyz
Source:	DNS query: qgkmsekougssaawq.xyz
Source:	DNS query: ggmwwewskeiggosq.xyz
Source:	DNS query: eqgwaamacqweiwie.xyz
Source:	DNS query: wmqcgwcegsomeqas.xyz
Source:	DNS query: oqummowmqwcgsegm.xyz
Source:	DNS query: qoowyoueaaaccgqs.xyz
Source:	DNS query: csiykwakekqoqaym.xyz
Source:	DNS query: mmymmauyiiksiugu.xyz
Source:	DNS query: cseksqccmgaieyic.xyz
Source:	DNS query: cykgucwkesokooyw.xyz
Source:	DNS query: okoguckagygoqqgk.xyz
Source:	DNS query: cyswykkcmggyiqwo.xyz
Source:	DNS query: gmmacaiigwcscggs.xyz
Source:	DNS query: yequgaccqouegcmw.xyz
Source:	DNS query: sksiyqgummyycgmi.xyz
Source:	DNS query: skekiggeimmceqcg.xyz
Source:	DNS query: eiqqequeskcqiqmw.xyz
Source:	DNS query: ecsamoyaimquqwow.xyz
Source:	DNS query: aiyksmkyqgyaemiw.xyz
Source:	DNS query: owewoieiwasaueco.xyz
Source:	DNS query: aoymcmmeqqqgwwca.xyz
Source:	DNS query: iygsiugeeogoeiyi.xyz
Source:	DNS query: quuemeewaqaiiyqc.xyz
Source:	DNS query: wggikwiqowiwqcqg.xyz
Source:	DNS query: ucuiiwcwwgimkyyi.xyz
Source:	DNS query: koiugmaqgkawaiyw.xyz
Source:	DNS query: waeqkmeeasauygum.xyz
Source:	DNS query: ecimsaauyieykegi.xyz
Source:	DNS query: ocsqocikkcggeaaw.xyz
Source:	DNS query: iyaqqeamygmakcgo.xyz
Source:	DNS query: uowgcyqcgaqiumoi.xyz
Source:	DNS query: myymasomksgeawqw.xyz
Source:	DNS query: myaueqycgeikwagc.xyz
Source:	DNS query: seoomaqwwimwueiw.xyz
Source:	DNS query: mgeycqkiwggsymyc.xyz
Source:	DNS query: ikgkgaaqqsmomuim.xyz
Source:	DNS query: ieuaeqceycqyqygk.xyz
Source:	DNS query: waeqwwagawqkksya.xyz
Source:	DNS query: mmeuqmoaekswggoe.xyz
Source:	DNS query: ucyoqcksaiiwgqae.xyz
Source:	DNS query: aoosomigeaiewqom.xyz
Source:	DNS query: cyqaqqcqamemsiog.xyz
Source:	DNS query: cyqaqqcqamemsiog.xyz
Source:	DNS query: wacqigcacsemkyos.xyz
Source:	DNS query: yqocoeikiyacyuck.xyz
Source:	DNS query: ywcuqkkmmqioiwqk.xyz
Source:	DNS query: waqcciyigkuoygqy.xyz
Source:	DNS query: ceoqyeiycqkumwao.xyz
Source:	DNS query: aauquiiqeugcwswc.xyz
Source:	DNS query: uoeiymqawsqiyuck.xyz
Source:	DNS query: uoeiymqawsqiyuck.xyz
Source:	DNS query: yqceweqmaumwwywy.xyz
Source:	DNS query: eqmycgagykgkqwsu.xyz
Source:	DNS query: seuuicaewuoaumes.xyz
Source:	DNS query: aomaeyokqgsuomii.xyz
Source:	DNS query: waqucgoeeeeymeii.xyz
Source:	DNS query: oqacqgmiaaewmmey.xyz
Source:	DNS query: ykeaoyaycoiamqey.xyz
Source:	DNS query: csmgwcogqqcwseka.xyz
Source:	DNS query: auowmussgaesgwas.xyz
Source:	DNS query: aikmouciiqgecoqi.xyz
Source:	DNS query: koecgqggegimaeya.xyz
Source:	DNS query: aawqwccomcemcysm.xyz
Source:	DNS query: kcyakwisycecaqgw.xyz
Source:	DNS query: uogksceymossmmqc.xyz
Source:	DNS query: qgmyeeguweaukuke.xyz
Source:	DNS query: mywaqkeaawisisky.xyz
Source:	DNS query: yqqsggacauiiugka.xyz
Source:	DNS query: equmqmqwuuuioawa.xyz
Source:	DNS query: wmoamsauiwauoosg.xyz
Source:	DNS query: oqsakkimkesccikc.xyz
Source:	DNS query: mgiwaegaqyyaakwy.xyz
Source:	DNS query: ucmioacycscyeouk.xyz
Source:	DNS query: qumaseqmggyaiauq.xyz
Source:	DNS query: uccyyemqaiiksuwm.xyz
Source:	DNS query: sesyieaiesegeaow.xyz
Source:	DNS query: kccmicaswqmswwak.xyz
Source:	DNS query: mssaogwocegysoow.xyz
Source:	DNS query: wssaqmakumewmaes.xyz
Source:	DNS query: cmukociggiqcouio.xyz
Source:	DNS query: skyqsyyymyacyayc.xyz
Source:	DNS query: uoigsiqmemcscosu.xyz
Source:	DNS query: kuywuskkgqsigqqs.xyz
Source:	DNS query: auayomwkewcomwas.xyz
Source:	DNS query: iyaikmkkowcqemsi.xyz
Source:	DNS query: ggicikyqcaiyguee.xyz
Source:	DNS query: oqyaoykomyoygics.xyz
Source:	DNS query: eqakguiwiqacqiwg.xyz
Source:	DNS query: wgcaouuqqqwucogy.xyz
Source:	DNS query: ewacuagosgqmuocm.xyz
Source:	DNS query: wgqyouayikuyuqmk.xyz
Source:	DNS query: owaaygsacguucaye.xyz
Source:	DNS query: uwgicagyykoommga.xyz
Source:	DNS query: uiggameqqycugsqw.xyz
Source:	DNS query: goguooqkgysueime.xyz
Source:	DNS query: keosqeosukqcooco.xyz
Source:	DNS query: maoeeogmuauywsyu.xyz
Source:	DNS query: ismqaewykmoiguki.xyz
Source:	DNS query: wucwykasawokemaw.xyz
Source:	DNS query: ukmcqucewskcqygg.xyz
Source:	DNS query: qqqmeagkkosgcayo.xyz
Source:	DNS query: ysawassgkwqygmmq.xyz
Source:	DNS query: osaeyoiqoqawauga.xyz
Source:	DNS query: iagisciiyoemgwaa.xyz
Source:	DNS query: ymysimqoykwqeqiq.xyz
Source:	DNS query: ymmcwogyimsuqmcc.xyz
Source:	DNS query: osmoygyawqmmimkq.xyz
Source:	DNS query: immyecuqwkiyscys.xyz
Source:	DNS query: immyecuqwkiyscys.xyz
Source:	DNS query: omsqkuiwcwoegooq.xyz
Source:	DNS query: ukaiiiyqoooycyqm.xyz
Source:	DNS query: isemauqkwwiumyky.xyz
Source:	DNS query: keguuyioweymiaws.xyz
Source:	DNS query: kwaywmaequkqccai.xyz
Source:	DNS query: yyimcoiwgckeakcm.xyz
Source:	DNS query: ekcwemuekgqsimae.xyz
Source:	DNS query: imigkomgmqgmakqk.xyz
Source:	DNS query: omasqkwqyskcagwi.xyz
Source:	DNS query: awyomscgweuqmgaw.xyz
Source:	DNS query: eyoyssauceguqwmk.xyz
Source:	DNS query: gwwcqeykmseicgaw.xyz
Source:	DNS query: qwywqgsmgaoiwsga.xyz
Source:	DNS query: ososwckwcqmmwqcy.xyz
Source:	DNS query: osaymwoggqqycmse.xyz
Source:	DNS query: oyewqwkusieeoqey.xyz
Source:	DNS query: ommwaqgaemsmcqwc.xyz
Source:	DNS query: cauewwukyywyqiei.xyz
Source:	DNS query: goeykqccmemkswom.xyz
Source:	DNS query: aksuakswwkiimamq.xyz
Source:	DNS query: isaeicumkcuwqmqq.xyz
Source:	DNS query: qiswokuokugiooky.xyz
Source:	DNS query: qiswcssocuqsaqkq.xyz
Source:	DNS query: qcyksokwumicscaa.xyz
Source:	DNS query: esiaisyasoaoqwki.xyz
Source:	DNS query: giqukkwwcwgqcisg.xyz
Source:	DNS query: ymqaaskiwomkucuy.xyz
Source:	DNS query: akueuaicusaoieiy.xyz
Source:	DNS query: sauygqecsusickcu.xyz
Source:	DNS query: kkwkgmcoawgaoiwg.xyz
Source:	DNS query: saumycuogqsqykes.xyz
Source:	DNS query: ukyokaigmmkumgoa.xyz
Source:	DNS query: eswweuycwwiiykwo.xyz
Source:	DNS query: uksgyqiqaaiaiesi.xyz
Source:	DNS query: smckcsaioceiyasu.xyz
Source:	DNS query: esimsqgcwwwmyoqc.xyz
Source:	DNS query: esimsqgcwwwmyoqc.xyz
Source:	DNS query: maiyuocqqiqiiskw.xyz
Source:	DNS query: smaaowemwiwggocu.xyz
Source:	DNS query: kwuuwgemogmuomwq.xyz
Source:	DNS query: ukicsmiwggcwksam.xyz
Source:	DNS query: gwamoggwyegsseao.xyz
Source:	DNS query: immcqsiceooqyaay.xyz
Source:	DNS query: kkcqgowgkcoyokcu.xyz
Source:	DNS query: kecgikusmakuksma.xyz
Source:	DNS query: ymuiggyusggsymoi.xyz
Source:	DNS query: uecouukwkuceyuwg.xyz
Source:	DNS query: eyoaceoookqskqmy.xyz
Source:	DNS query: awwomgcseeqwkkom.xyz
Source:	DNS query: keykoekseemyiewq.xyz
Source:	DNS query: ysiwwoeeaaskykaw.xyz
Source:	DNS query: kwmcuwccqmuecgea.xyz
Source:	DNS query: gwyooeiscmwguqms.xyz
Source:	DNS query: wuokiysmiucoucak.xyz
Source:	DNS query: wuuiumemmigyyauq.xyz
Source:	DNS query: acwomuuukiomgqkm.xyz
Source:	DNS query: muwqwgaaymomgwmi.xyz
Source:	DNS query: omgcoecwsqiuqyug.xyz
Source:	DNS query: kqmsgskwgemyueya.xyz
Source:	DNS query: eyiyueewuaqmmwcm.xyz
Source:	DNS query: gwoyamckoqoaauoq.xyz
Source:	DNS query: gwoyamckoqoaauoq.xyz
Source:	DNS query: qwqsoyoqkymakowm.xyz
Source:	DNS query: gcmiymmqgwuquokm.xyz
Source:	DNS query: ymseciekayuweoww.xyz
Source:	DNS query: oyocwswugeiqqyoo.xyz
Source:	DNS query: omgooecquoweeomo.xyz
Source:	DNS query: imgeoyougkmmeuec.xyz
Source:	DNS query: smoswyoekkccyuga.xyz
Source:	DNS query: suwkomiqcykeyako.xyz
Source:	DNS query: smwsugycuuckemue.xyz
Source:	DNS query: qigcqiaomwieqwka.xyz
Source:	DNS query: qigcqiaomwieqwka.xyz
Source:	DNS query: oekcyqqggaegsesm.xyz
Source:	DNS query: qcoysaaooaiccqyu.xyz
Source:	DNS query: mismuqiygyeysaoo.xyz
Source:	DNS query: wockoyekyageakcg.xyz
Source:	DNS query: ososokqeakgguwsq.xyz
Source:	DNS query: wcgqccqcugomywua.xyz
Source:	DNS query: aqaqgemescmwsqks.xyz
Source:	DNS query: aqiwocaywcswuwsq.xyz
Source:	DNS query: aqgmgoqcoqqkguyk.xyz
Source:	DNS query: oywgqkusocouysua.xyz
Source:	DNS query: uyygagweoagcuqky.xyz
Source:	DNS query: muiccguyaeaqwweg.xyz
Source:	DNS query: qiqueqokwqqgwwci.xyz
Source:	DNS query: uygmgoymcwcgkios.xyz
Source:	DNS query: qiyggmguowygeooc.xyz
Source:	DNS query: acacoiqgoimayqwm.xyz
Source:	DNS query: smisyqewaummmwoc.xyz

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: akaueuwoocwkkoya.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kwaywmaequkqccai.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: myaueqycgeikwagc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: acgcaiyykiigugms.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gwwcqeykmseicgaw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wiywykakusaygisc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gaisoawuoicqsumy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kqmsgskwgemyueya.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gwoyamckoqoaauoq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smisyqewaummmwoc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yquocucuqoywwcsu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ukmcqucewskcqygg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oqyaoykomyoygics.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: quisoakcuqsygyyc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kcsqwmkusesaccwa.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ecacmycegqoaquio.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ecmckkeyoskcigeu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uceaygkekiassamu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wuusiiukmwcmimyk.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smaaowemwiwggocu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qokykyyigsyqggqe.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uoaeyoycyycqkoci.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yyusosuyycoeikgo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gwamoggwyegsseao.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mmisquwegymayaee.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ieuaeqceycqyqygk.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cyyyokugycioysok.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gmooqswyuuqaiomi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: auayomwkewcomwas.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: seioywksogeseqig.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kckcekceqgcyqcsa.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: skekiggeimmceqcg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: osaeyoiqoqawauga.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ymysimqoykwqeqiq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ymqaaskiwomkucuy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eqmeimmouegoasay.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oqacqgmiaaewmmey.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uoeiymqawsqiyuck.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ykeaoyaycoiamqey.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ymseciekayuweoww.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aiyksmkyqgyaemiw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qwywqgsmgaoiwsga.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uoeeuiaewmogugeo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: okgeqaswygsgykme.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kcyakwisycecaqgw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: acwomuuukiomgqkm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gacgceaygaecuguy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qiyggmguowygeooc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yegskieoocgoamyi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: suwkomiqcykeyako.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wuokiysmiucoucak.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ggqgwuaseamkyywa.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oyewqwkusieeoqey.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ommwaqgaemsmcqwc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qiswokuokugiooky.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wssaqmakumewmaes.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iyawyckqggkwsyoq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gmmacaiigwcscggs.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: seuuicaewuoaumes.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ykocagogmeiwmymy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sssawsmmkmuyqsaq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iygsiugeeogoeiyi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yqceweqmaumwwywy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ismqaewykmoiguki.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wggikwiqowiwqcqg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ggwsuoyyioagegkw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ssoqscyewimqiqme.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uqyukkamycuaimsu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: okoguckagygoqqgk.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: keosqeosukqcooco.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gcmiymmqgwuquokm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: isemauqkwwiumyky.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qgmyeeguweaukuke.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uygmgoymcwcgkios.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ywqiciegywcouoiy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qciqgoeogwwmwkcw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: muiccguyaeaqwweg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: waeqkmeeasauygum.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: waqcciyigkuoygqy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: keykoekseemyiewq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wgcaouuqqqwucogy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: omsqkuiwcwoegooq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qiuswcgwaqgemwcg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kqsamcsauqiagmma.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oqummowmqwcgsegm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ymuiggyusggsymoi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eqkkkcuwkiqiecac.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uyygagweoagcuqky.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: miacggmycyqikoyq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: imgeoyougkmmeuec.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ggmwwewskeiggosq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: immyecuqwkiyscys.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eiqqequeskcqiqmw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qgukewuuykmmkgeq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: myymasomksgeawqw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: woeamasicuiqyckq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qwmaokcmiwuqqyes.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qoowyoueaaaccgqs.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oyocwswugeiqqyoo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kcesagqugouwkqyg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: woceumwmwioocusa.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aawqwccomcemcysm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eyoyssauceguqwmk.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: waqmyueimmyiuawq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cycscsqyqkeaykgc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kocgeaeoakgqewog.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: skgcsksqyekiymii.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mmyukmsqamgicqai.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ukyokaigmmkumgoa.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ucyoqcksaiiwgqae.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ikoqkscwsowwukmi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ososwckwcqmmwqcy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cykgucwkesokooyw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ecmyomcaicqysoqw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uogksceymossmmqc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aauquiiqeugcwswc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ywkamsiogkycyosy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mmeuqmoaekswggoe.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: koiugmaqgkawaiyw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kqukwaogqoucsaas.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ykomskascimimomo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kcqkucqkogqiuukw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aksuakswwkiimamq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qigcqiaomwieqwka.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aqiwocaywcswuwsq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ykaimcgigakggwec.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cuccygameukkeumw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kuoqgwooymgsqaum.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aoymcmmeqqqgwwca.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ysoqqwckkqssyigm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iqmeccigieosgmwq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ecsamoyaimquqwow.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qcoysaaooaiccqyu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ceeomiecgymecgau.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ikwyuqgsegcgcccg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mgeycqkiwggsymyc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qiswcssocuqsaqkq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uykkwkqqemamguwa.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: akueuaicusaoieiy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gakowseyscmeqkya.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: esiaisyasoaoqwki.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oqoemaogyoikomiy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: seoomaqwwimwueiw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oqegmuqkgyaywwmc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: esimsqgcwwwmyoqc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ikgkgaaqqsmomuim.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: skyqsyyymyacyayc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eyoaceoookqskqmy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kkcqgowgkcoyokcu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oyekqyccewougasu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ucmioacycscyeouk.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qusmiuqmmgqsgeci.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gwyooeiscmwguqms.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yqeugeoquqsokgqk.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ukicsmiwggcwksam.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: osaymwoggqqycmse.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: awwomgcseeqwkkom.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: csoqiicgaaiyyoom.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cmukociggiqcouio.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aqgmgoqcoqqkguyk.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iyaqqeamygmakcgo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cyyukyomsoiqyyqa.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uwimwwicgcscuoku.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: keguuyioweymiaws.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: omgooecquoweeomo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kuiqsugkqeoscguo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ggeqowwmmmeekigg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wukaqiusicksuguo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uowgcyqcgaqiumoi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ieikmuieoqqmugwu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: guimuaoiecmouigq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: igaiseoqksuoukqg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aaiouwywwcwuuasm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: equmqmqwuuuioawa.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qgkgogieieoomkqq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kuywuskkgqsigqqs.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aosywgkogcissggi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ukekykoqskumoikg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: myoyccuwcyaygceg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gcikuiqswcgsscog.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ymsaymyugccysmow.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: miigookwguakmkeu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mssaogwocegysoow.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oywgqkusocouysua.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: quoqoooiamqkkosc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yyimcoiwgckeakcm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ekcwemuekgqsimae.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oqsakkimkesccikc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eqmycgagykgkqwsu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uwgicagyykoommga.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: omgcoecwsqiuqyug.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ggicikyqcaiyguee.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: owaaygsacguucaye.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aomaeyokqgsuomii.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mgseamqmgkqcuewy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ssagiiaauyewiswa.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iyaikmkkowcqemsi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wgqyouayikuyuqmk.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ecgkeyeueawgcuqo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mgwmkyyqckeewgce.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smoswyoekkccyuga.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wgyimykogekgewoa.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: koecgqggegimaeya.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: giqukkwwcwgqcisg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ucwesqiquqggymqe.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ywyawywiuyecuiuu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qumaseqmggyaiauq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gaoweoyqcuuykwgu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: okkyekwuommcicqi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iymukyseoieqccac.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: goeykqccmemkswom.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kqoceoymymoicqky.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qascmswkaisogoaq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: isaeicumkcuwqmqq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smckcsaioceiyasu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ucuiiwcwwgimkyyi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ysiwwoeeaaskykaw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kuiomoiwauwckqeq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yyemsyoimicqmais.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eqakguiwiqacqiwg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ikwyooieywakeqog.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wsaekoiomeagsaes.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cyqaqqcqamemsiog.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mismuqiygyeysaoo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uiguoqqagkiuagyc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wockoyekyageakcg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ecimsaauyieykegi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: osmoygyawqmmimkq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ukaiiiyqoooycyqm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mmymmauyiiksiugu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eqgwaamacqweiwie.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wmoamsauiwauoosg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: omuquowgiusiesgk.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iagisciiyoemgwaa.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mgiwaegaqyyaakwy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iqcqqquiwomgsmma.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sauygqecsusickcu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eqyyguuwsyqaqgsq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kwuuwgemogmuomwq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: waqucgoeeeeymeii.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: csmgwcogqqcwseka.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: owoksuegymmgesys.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: maiyuocqqiqiiskw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uymiagmwmqmimewm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mywaqkeaawisisky.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wucwykasawokemaw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ceoqyeiycqkumwao.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qgkmsekougssaawq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: saumycuogqsqykes.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aoosomigeaiewqom.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qogsmcecyusiyaim.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oekcyqqggaegsesm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ykqocceawkwoagmc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qwqsoyoqkymakowm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smwsugycuuckemue.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wgymkeismmiemsqq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: maoeeogmuauywsyu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: muwqwgaaymomgwmi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ceucuuwiwwuiweaq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aqaqgemescmwsqks.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uokqeaieowiogsgc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kccmicaswqmswwak.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cyswykkcmggyiqwo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: imigkomgmqgmakqk.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ssegwgieumyoasym.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: omasqkwqyskcagwi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uoigsiqmemcscosu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cauewwukyywyqiei.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qiqueqokwqqgwwci.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ieywwkeuouoqgqms.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sksiyqgummyycgmi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: auuisqaykqgeesae.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eyiyueewuaqmmwcm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kwmcuwccqmuecgea.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cseksqccmgaieyic.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ysawassgkwqygmmq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: myisokqwsmqeusuy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mocikyoeikocwkuc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ywcuqkkmmqioiwqk.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oqouwceoowyiwgag.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ewacuagosgqmuocm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ywegqamoegumacgi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: owewoieiwasaueco.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: koioiiwouukqousy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ewywcoeukaoaegci.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kcyoeiykekuqkkmg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uccyyemqaiiksuwm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kigcewceemkckeow.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oekyamueeiiousia.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yekiwquqaacesqqq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ymmcwogyimsuqmcc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kkwkgmcoawgaoiwg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aamuskacaaiycguu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: waokmuyyeooamowm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wmqcgwcegsomeqas.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wacqigcacsemkyos.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: awyomscgweuqmgaw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cogsyycsuwoysugi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: auowmussgaesgwas.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mmygsewuukqkiiok.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yqocoeikiyacyuck.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cykgmsqcgysgaioo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aikmouciiqgecoqi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wgswkwaesqqwkoaa.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yqqsggacauiiugka.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qcyksokwumicscaa.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aqmqywkwsmmayyoi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sesyieaiesegeaow.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wcgqccqcugomywua.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ggkyuooyikmqoscw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gmwcscokucowyogs.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eigkgwkyuqssgamw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uowowiqiyeiuwmcc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eswweuycwwiiykwo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yequgaccqouegcmw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uyqcacmsiquuwggq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qqqmeagkkosgcayo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ggkyecqguqkkuoso.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: waeqwwagawqkksya.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uecouukwkuceyuwg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kecgikusmakuksma.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qoiiomimuoaqgeku.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: quuemeewaqaiiyqc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ocsqocikkcggeaaw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uksgyqiqaaiaiesi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uiggameqqycugsqw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: immcqsiceooqyaay.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: acacoiqgoimayqwm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yqcakkmwigkaumii.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ososokqeakgguwsq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: csiykwakekqoqaym.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: goguooqkgysueime.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wuuiumemmigyyauq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iqcaysimoeeqamky.xyz replaycode: Name error (3)

Source: unknown

Network traffic detected: DNS query count 336

Source: global traffic

DNS traffic detected: number of DNS queries: 336

Source: Joe Sandbox View

ASN Name: GLESYS-ASSE GLESYS-ASSE

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe

Code function: 13_2_004EA5B0 recv,recv,

13_2_004EA5B0

Source: global traffic

HTTP traffic detected: GET /api/client_hello HTTP/1.1Accept: */*Connection: closeHost: keoqiqigggqkcykq.xyz:443User-Agent: cpp-httplib/0.12.1

Source: global traffic	DNS traffic detected: DNS query: qckwwsmukogkeuge.xyz
Source: global traffic	DNS traffic detected: DNS query: keoqiqigggqkcykq.xyz
Source: global traffic	DNS traffic detected: DNS query: kqsamcsauqiagmma.xyz
Source: global traffic	DNS traffic detected: DNS query: mocikyoeikocwkuc.xyz
Source: global traffic	DNS traffic detected: DNS query: uymiagmwmqmimewm.xyz
Source: global traffic	DNS traffic detected: DNS query: gcikuiqswcgsscog.xyz
Source: global traffic	DNS traffic detected: DNS query: qwmaokcmiwuqqyes.xyz
Source: global traffic	DNS traffic detected: DNS query: igaiseoqksuoukqg.xyz
Source: global traffic	DNS traffic detected: DNS query: kqukwaogqoucsaas.xyz
Source: global traffic	DNS traffic detected: DNS query: miacggmycyqikoyq.xyz
Source: global traffic	DNS traffic detected: DNS query: woceumwmwioocusa.xyz
Source: global traffic	DNS traffic detected: DNS query: acgcaiyykiigugms.xyz
Source: global traffic	DNS traffic detected: DNS query: cogsyycsuwoysugi.xyz
Source: global traffic	DNS traffic detected: DNS query: oekyamueeiiousia.xyz
Source: global traffic	DNS traffic detected: DNS query: wukaqiusicksuguo.xyz
Source: global traffic	DNS traffic detected: DNS query: yyusosuyycoeikgo.xyz
Source: global traffic	DNS traffic detected: DNS query: kqoceoymymoicqky.xyz
Source: global traffic	DNS traffic detected: DNS query: uykkwkqqemamguwa.xyz
Source: global traffic	DNS traffic detected: DNS query: oyekqyccewougasu.xyz
Source: global traffic	DNS traffic detected: DNS query: ymsaymyugccysmow.xyz
Source: global traffic	DNS traffic detected: DNS query: omuquowgiusiesgk.xyz
Source: global traffic	DNS traffic detected: DNS query: wiywykakusaygisc.xyz
Source: global traffic	DNS traffic detected: DNS query: aqmqywkwsmmayyoi.xyz
Source: global traffic	DNS traffic detected: DNS query: cuccygameukkeumw.xyz
Source: global traffic	DNS traffic detected: DNS query: ukekykoqskumoikg.xyz
Source: global traffic	DNS traffic detected: DNS query: uyqcacmsiquuwggq.xyz
Source: global traffic	DNS traffic detected: DNS query: ysoqqwckkqssyigm.xyz
Source: global traffic	DNS traffic detected: DNS query: yyemsyoimicqmais.xyz
Source: global traffic	DNS traffic detected: DNS query: miigookwguakmkeu.xyz
Source: global traffic	DNS traffic detected: DNS query: qiuswcgwaqgemwcg.xyz
Source: global traffic	DNS traffic detected: DNS query: wuusiiukmwcmimyk.xyz
Source: global traffic	DNS traffic detected: DNS query: uqyukkamycuaimsu.xyz
Source: global traffic	DNS traffic detected: DNS query: woeamasicuiqyckq.xyz
Source: global traffic	DNS traffic detected: DNS query: akaueuwoocwkkoya.xyz
Source: global traffic	DNS traffic detected: DNS query: qciqgoeogwwmwkcw.xyz
Source: global traffic	DNS traffic detected: DNS query: ucwesqiquqggymqe.xyz
Source: global traffic	DNS traffic detected: DNS query: mgseamqmgkqcuewy.xyz
Source: global traffic	DNS traffic detected: DNS query: gaoweoyqcuuykwgu.xyz
Source: global traffic	DNS traffic detected: DNS query: oqegmuqkgyaywwmc.xyz
Source: global traffic	DNS traffic detected: DNS query: qusmiuqmmgqsgeci.xyz
Source: global traffic	DNS traffic detected: DNS query: yqcakkmwigkaumii.xyz
Source: global traffic	DNS traffic detected: DNS query: qokykyyigsyqggqe.xyz
Source: global traffic	DNS traffic detected: DNS query: cyyyokugycioysok.xyz
Source: global traffic	DNS traffic detected: DNS query: iqcaysimoeeqamky.xyz
Source: global traffic	DNS traffic detected: DNS query: yekiwquqaacesqqq.xyz
Source: global traffic	DNS traffic detected: DNS query: gmooqswyuuqaiomi.xyz
Source: global traffic	DNS traffic detected: DNS query: kuiomoiwauwckqeq.xyz
Source: global traffic	DNS traffic detected: DNS query: ceucuuwiwwuiweaq.xyz
Source: global traffic	DNS traffic detected: DNS query: cycscsqyqkeaykgc.xyz
Source: global traffic	DNS traffic detected: DNS query: ssagiiaauyewiswa.xyz
Source: global traffic	DNS traffic detected: DNS query: ggwsuoyyioagegkw.xyz
Source: global traffic	DNS traffic detected: DNS query: ieikmuieoqqmugwu.xyz
Source: global traffic	DNS traffic detected: DNS query: kcqkucqkogqiuukw.xyz
Source: global traffic	DNS traffic detected: DNS query: oqouwceoowyiwgag.xyz
Source: global traffic	DNS traffic detected: DNS query: gakowseyscmeqkya.xyz
Source: global traffic	DNS traffic detected: DNS query: quisoakcuqsygyyc.xyz
Source: global traffic	DNS traffic detected: DNS query: auuisqaykqgeesae.xyz
Source: global traffic	DNS traffic detected: DNS query: iyawyckqggkwsyoq.xyz
Source: global traffic	DNS traffic detected: DNS query: ecmyomcaicqysoqw.xyz
Source: global traffic	DNS traffic detected: DNS query: iqcqqquiwomgsmma.xyz
Source: global traffic	DNS traffic detected: DNS query: ssegwgieumyoasym.xyz
Source: global traffic	DNS traffic detected: DNS query: ceeomiecgymecgau.xyz
Source: global traffic	DNS traffic detected: DNS query: myisokqwsmqeusuy.xyz
Source: global traffic	DNS traffic detected: DNS query: ywkamsiogkycyosy.xyz
Source: global traffic	DNS traffic detected: DNS query: ggkyecqguqkkuoso.xyz
Source: global traffic	DNS traffic detected: DNS query: kcyoeiykekuqkkmg.xyz
Source: global traffic	DNS traffic detected: DNS query: ikwyuqgsegcgcccg.xyz
Source: global traffic	DNS traffic detected: DNS query: wgswkwaesqqwkoaa.xyz
Source: global traffic	DNS traffic detected: DNS query: eqkkkcuwkiqiecac.xyz
Source: global traffic	DNS traffic detected: DNS query: kigcewceemkckeow.xyz
Source: global traffic	DNS traffic detected: DNS query: ykaimcgigakggwec.xyz
Source: global traffic	DNS traffic detected: DNS query: uceaygkekiassamu.xyz
Source: global traffic	DNS traffic detected: DNS query: seioywksogeseqig.xyz
Source: global traffic	DNS traffic detected: DNS query: ssoqscyewimqiqme.xyz
Source: global traffic	DNS traffic detected: DNS query: kocgeaeoakgqewog.xyz
Source: global traffic	DNS traffic detected: DNS query: kuiqsugkqeoscguo.xyz
Source: global traffic	DNS traffic detected: DNS query: kcsqwmkusesaccwa.xyz
Source: global traffic	DNS traffic detected: DNS query: ywyawywiuyecuiuu.xyz
Source: global traffic	DNS traffic detected: DNS query: uowowiqiyeiuwmcc.xyz
Source: global traffic	DNS traffic detected: DNS query: uokqeaieowiogsgc.xyz
Source: global traffic	DNS traffic detected: DNS query: ikoqkscwsowwukmi.xyz
Source: global traffic	DNS traffic detected: DNS query: iymukyseoieqccac.xyz
Source: global traffic	DNS traffic detected: DNS query: qascmswkaisogoaq.xyz
Source: global traffic	DNS traffic detected: DNS query: gacgceaygaecuguy.xyz
Source: global traffic	DNS traffic detected: DNS query: eqyyguuwsyqaqgsq.xyz
Source: global traffic	DNS traffic detected: DNS query: ewywcoeukaoaegci.xyz
Source: global traffic	DNS traffic detected: DNS query: mmygsewuukqkiiok.xyz
Source: global traffic	DNS traffic detected: DNS query: wgyimykogekgewoa.xyz
Source: global traffic	DNS traffic detected: DNS query: uiguoqqagkiuagyc.xyz
Source: global traffic	DNS traffic detected: DNS query: kcesagqugouwkqyg.xyz
Source: global traffic	DNS traffic detected: DNS query: yqeugeoquqsokgqk.xyz
Source: global traffic	DNS traffic detected: DNS query: eigkgwkyuqssgamw.xyz
Source: global traffic	DNS traffic detected: DNS query: waqmyueimmyiuawq.xyz
Source: global traffic	DNS traffic detected: DNS query: qgukewuuykmmkgeq.xyz
Source: global traffic	DNS traffic detected: DNS query: gmwcscokucowyogs.xyz
Source: global traffic	DNS traffic detected: DNS query: ywegqamoegumacgi.xyz
Source: global traffic	DNS traffic detected: DNS query: yquocucuqoywwcsu.xyz
Source: global traffic	DNS traffic detected: DNS query: eqmeimmouegoasay.xyz
Source: global traffic	DNS traffic detected: DNS query: cykgmsqcgysgaioo.xyz
Source: global traffic	DNS traffic detected: DNS query: oqoemaogyoikomiy.xyz

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3a9a03.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{D425ECE9-AA22-4FB8-9E95-B5A59C391C55}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9DBC.tmp	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004E9070	13_2_004E9070
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004E43E0	13_2_004E43E0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004F23B0	13_2_004F23B0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004F75A0	13_2_004F75A0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00588650	13_2_00588650
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00490750	13_2_00490750
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00492A50	13_2_00492A50
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004DEEF0	13_2_004DEEF0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00543050	13_2_00543050
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004D0040	13_2_004D0040
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00509040	13_2_00509040
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00441000	13_2_00441000
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004CA000	13_2_004CA000
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00442010	13_2_00442010
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005850C0	13_2_005850C0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004A10D0	13_2_004A10D0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005210E0	13_2_005210E0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004FF0F0	13_2_004FF0F0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0052E080	13_2_0052E080
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0053B150	13_2_0053B150
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00563150	13_2_00563150
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00469160	13_2_00469160
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00562170	13_2_00562170
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00500110	13_2_00500110
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00542110	13_2_00542110
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00575100	13_2_00575100
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004B5110	13_2_004B5110
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00472120	13_2_00472120
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004AC120	13_2_004AC120
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004671D0	13_2_004671D0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004B31D0	13_2_004B31D0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0052B1F0	13_2_0052B1F0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004551E0	13_2_004551E0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0057B1E0	13_2_0057B1E0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00514190	13_2_00514190
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004CD180	13_2_004CD180
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0050E1A0	13_2_0050E1A0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0053D1A0	13_2_0053D1A0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0057E1A0	13_2_0057E1A0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0053E250	13_2_0053E250
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004FB240	13_2_004FB240
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004FA240	13_2_004FA240
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004C4250	13_2_004C4250
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00456260	13_2_00456260
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0052F210	13_2_0052F210
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00481200	13_2_00481200
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004BF200	13_2_004BF200
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00522200	13_2_00522200
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00460210	13_2_00460210
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00470210	13_2_00470210
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005762F0	13_2_005762F0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0050D2E0	13_2_0050D2E0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004462F0	13_2_004462F0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0057D2E0	13_2_0057D2E0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005892E0	13_2_005892E0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004DA2F0	13_2_004DA2F0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0044F280	13_2_0044F280
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004C7290	13_2_004C7290
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005352A0	13_2_005352A0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0050C340	13_2_0050C340
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00546310	13_2_00546310
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00513300	13_2_00513300
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0051E300	13_2_0051E300
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0053A300	13_2_0053A300
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0047E310	13_2_0047E310
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0049E310	13_2_0049E310
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005253F0	13_2_005253F0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004AE3E0	13_2_004AE3E0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0049B390	13_2_0049B390
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004523A0	13_2_004523A0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00537450	13_2_00537450
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00557450	13_2_00557450
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00572450	13_2_00572450
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004A8450	13_2_004A8450
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00549470	13_2_00549470
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00582470	13_2_00582470
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004FE460	13_2_004FE460
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00526410	13_2_00526410
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00536410	13_2_00536410
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0044B420	13_2_0044B420
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00474420	13_2_00474420
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004F0420	13_2_004F0420
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004CE4C0	13_2_004CE4C0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005394C0	13_2_005394C0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004D34D0	13_2_004D34D0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004E64D0	13_2_004E64D0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004544E0	13_2_004544E0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0055B4E0	13_2_0055B4E0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004974F0	13_2_004974F0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004C04F0	13_2_004C04F0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00532490	13_2_00532490
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0049F480	13_2_0049F480
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00508480	13_2_00508480
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004CA4A0	13_2_004CA4A0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004E24A0	13_2_004E24A0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005014A0	13_2_005014A0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00566550	13_2_00566550
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00564540	13_2_00564540
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0046B560	13_2_0046B560
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00587510	13_2_00587510
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00517500	13_2_00517500
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00579500	13_2_00579500
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004FD510	13_2_004FD510
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004E7530	13_2_004E7530
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005285C0	13_2_005285C0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004515E0	13_2_004515E0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0056E5E0	13_2_0056E5E0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0044D5B0	13_2_0044D5B0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004505B0	13_2_004505B0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00447640	13_2_00447640
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004E5650	13_2_004E5650
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0050A660	13_2_0050A660
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0050C660	13_2_0050C660
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00546610	13_2_00546610
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00577630	13_2_00577630
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004C3620	13_2_004C3620
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004DB620	13_2_004DB620
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00541620	13_2_00541620
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00554620	13_2_00554620
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0056D620	13_2_0056D620
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004D1630	13_2_004D1630
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005386C0	13_2_005386C0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0056F6C0	13_2_0056F6C0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005486F0	13_2_005486F0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0049C690	13_2_0049C690
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004A16A0	13_2_004A16A0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004996B0	13_2_004996B0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004A06B0	13_2_004A06B0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004D06B0	13_2_004D06B0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0050E770	13_2_0050E770
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0044F760	13_2_0044F760
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0047F760	13_2_0047F760
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00468770	13_2_00468770
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00473730	13_2_00473730
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0049B730	13_2_0049B730
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0052C7D0	13_2_0052C7D0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005337D0	13_2_005337D0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004647C0	13_2_004647C0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0057A7D0	13_2_0057A7D0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0056B7C0	13_2_0056B7C0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004B97D0	13_2_004B97D0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0055E7E0	13_2_0055E7E0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00529790	13_2_00529790
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004C5780	13_2_004C5780
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00534780	13_2_00534780
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005AD780	13_2_005AD780
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005107B0	13_2_005107B0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00507850	13_2_00507850
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0052A850	13_2_0052A850
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0055C850	13_2_0055C850
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0057F850	13_2_0057F850
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00514840	13_2_00514840
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00587840	13_2_00587840
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00452860	13_2_00452860
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0058A870	13_2_0058A870
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004CB860	13_2_004CB860
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004F6870	13_2_004F6870
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0049C810	13_2_0049C810
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004F5810	13_2_004F5810
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005C783D	13_2_005C783D
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005218C0	13_2_005218C0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0057D8F0	13_2_0057D8F0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0052D8E0	13_2_0052D8E0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005428B0	13_2_005428B0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005748B0	13_2_005748B0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005B08B0	13_2_005B08B0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004F48B0	13_2_004F48B0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004AB940	13_2_004AB940
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004CD940	13_2_004CD940
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00449950	13_2_00449950
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0052B910	13_2_0052B910
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00500930	13_2_00500930
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0051C920	13_2_0051C920
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005689D0	13_2_005689D0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004D29D0	13_2_004D29D0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0056D9F0	13_2_0056D9F0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0050A990	13_2_0050A990
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004AC980	13_2_004AC980
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004B69A0	13_2_004B69A0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0057C9A0	13_2_0057C9A0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004DA9B0	13_2_004DA9B0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00531A50	13_2_00531A50
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00549A40	13_2_00549A40
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00530A60	13_2_00530A60
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004F8A00	13_2_004F8A00
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004E0A10	13_2_004E0A10
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00541A20	13_2_00541A20
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00557A20	13_2_00557A20
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005B7A2D	13_2_005B7A2D
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0053AAF0	13_2_0053AAF0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004AFA80	13_2_004AFA80
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0056AA80	13_2_0056AA80
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0051AAB0	13_2_0051AAB0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00446AA0	13_2_00446AA0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00520AA0	13_2_00520AA0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0044BAB0	13_2_0044BAB0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00537B50	13_2_00537B50
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0053CB50	13_2_0053CB50
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004D1B50	13_2_004D1B50
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004E3B60	13_2_004E3B60
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004FBB70	13_2_004FBB70
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00450B00	13_2_00450B00
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004EDB20	13_2_004EDB20
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00456BC0	13_2_00456BC0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00454BC0	13_2_00454BC0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004B3BC0	13_2_004B3BC0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004FFBD0	13_2_004FFBD0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00532BF0	13_2_00532BF0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00558BE0	13_2_00558BE0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00483B80	13_2_00483B80
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0057BBB0	13_2_0057BBB0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004C2BA0	13_2_004C2BA0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00463BB0	13_2_00463BB0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0047CC50	13_2_0047CC50
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00522C70	13_2_00522C70
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0053DC60	13_2_0053DC60
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0055CC60	13_2_0055CC60
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00461C70	13_2_00461C70
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00573C60	13_2_00573C60
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0051FC10	13_2_0051FC10
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00524C00	13_2_00524C00
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0048FC10	13_2_0048FC10
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00585C20	13_2_00585C20
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004D7C30	13_2_004D7C30
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0044FCC0	13_2_0044FCC0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00561CF0	13_2_00561CF0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00571CF0	13_2_00571CF0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004B9CE0	13_2_004B9CE0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004F6CF0	13_2_004F6CF0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00569C80	13_2_00569C80
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004CBC90	13_2_004CBC90
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00506CB0	13_2_00506CB0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0044ECA0	13_2_0044ECA0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00448CB0	13_2_00448CB0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004EACB0	13_2_004EACB0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004C8D40	13_2_004C8D40
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004EBD40	13_2_004EBD40
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0057CD40	13_2_0057CD40
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004ACD60	13_2_004ACD60
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004C7D60	13_2_004C7D60
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004C4D00	13_2_004C4D00
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00544D30	13_2_00544D30
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00469D20	13_2_00469D20
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0046AD20	13_2_0046AD20
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004D6DC0	13_2_004D6DC0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004EFDE0	13_2_004EFDE0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00509DE0	13_2_00509DE0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004D9DF0	13_2_004D9DF0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004A5D90	13_2_004A5D90
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0055FDB0	13_2_0055FDB0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00570DB0	13_2_00570DB0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00582DB0	13_2_00582DB0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004A0DA0	13_2_004A0DA0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00516DA0	13_2_00516DA0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004B8DB0	13_2_004B8DB0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004DBDB0	13_2_004DBDB0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00512E50	13_2_00512E50
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004F0E40	13_2_004F0E40
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0049DE50	13_2_0049DE50
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00567E60	13_2_00567E60
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00467E30	13_2_00467E30
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00471E30	13_2_00471E30
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005C2E26	13_2_005C2E26
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005C2EDE	13_2_005C2EDE
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00533ED0	13_2_00533ED0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004B6ED0	13_2_004B6ED0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00566EF0	13_2_00566EF0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00563EE0	13_2_00563EE0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00528E90	13_2_00528E90
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00531E90	13_2_00531E90
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004AEE80	13_2_004AEE80
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004D0E80	13_2_004D0E80
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00560E80	13_2_00560E80
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00504EB0	13_2_00504EB0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00449EA0	13_2_00449EA0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00549EB0	13_2_00549EB0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00568EB0	13_2_00568EB0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00572EB0	13_2_00572EB0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00451F50	13_2_00451F50
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00511F10	13_2_00511F10
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004D4F00	13_2_004D4F00
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0050EF00	13_2_0050EF00
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00527F20	13_2_00527F20
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0052BF20	13_2_0052BF20
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00517FC0	13_2_00517FC0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00518F80	13_2_00518F80
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004D8F90	13_2_004D8F90
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0044CFA0	13_2_0044CFA0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0050CFA0	13_2_0050CFA0
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0049EFB0	13_2_0049EFB0

Source: Joe Sandbox View

Dropped File: C:\Windows\Installer\MSI9DBC.tmp FD622CF73EA951A6DE631063ABA856487D77745DD1500ADCA61902B8DDE56FE1

Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: String function: 005AC1A0 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: String function: 00454260 appears 48 times

Source: classification engine

Classification label: mal88.troj.evad.winMSI@12/12@342/1

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4440:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4616:120:WilError_03

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DFDBE736A01738D6FA.TMP

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

File read: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\msiwrapper.ini

Jump to behavior

Source: C:\Windows\SysWOW64\icacls.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2Wr5r2e9vo.msi	Virustotal: Detection: 28%
Source: 2Wr5r2e9vo.msi	ReversingLabs: Detection: 29%

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\2Wr5r2e9vo.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding C87318A1E88CD27EAD404D332FBFE39C
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
Source: C:\Windows\SysWOW64\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\expand.exe "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
Source: C:\Windows\SysWOW64\expand.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe "C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe" /VERYSILENT /VERYSILENT
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding C87318A1E88CD27EAD404D332FBFE39C	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\." /SETINTEGRITYLEVEL (CI)(OI)HIGH	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\expand.exe "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe "C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe" /VERYSILENT /VERYSILENT	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: wdscore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

File written: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\msiwrapper.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 2Wr5r2e9vo.msi

Static file information: File size 1908736 > 1048576

Source:

Binary string: C:\ss2\Projects\MsiWrapper\MsiCustomActions\Release\MsiCustomActions.pdb source: 2Wr5r2e9vo.msi, 3a9a03.msi.2.dr, MSI9DBC.tmp.2.dr

Source: 8cccbf84c3e089418139dd95981f2766.tmp.6.dr	Static PE information: section name: .00cfg
Source: 8cccbf84c3e089418139dd95981f2766.tmp.6.dr	Static PE information: section name: .voltbl

Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00492A50 push eax; mov dword ptr [esp], ecx	13_2_00492A52
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00455170 push eax; mov dword ptr [esp], ecx	13_2_00455173
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005AC35A push ecx; ret	13_2_005AC36D
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00461390 push eax; mov dword ptr [esp], ecx	13_2_00461391
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_0046F4B0 push eax; mov dword ptr [esp], ecx	13_2_0046F4B5
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005155D0 push eax; mov dword ptr [esp], ecx	13_2_005155D5
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_004636F0 push eax; mov dword ptr [esp], ecx	13_2_004636F5
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00492940 push eax; mov dword ptr [esp], ecx	13_2_00492944
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00453AD0 push eax; mov dword ptr [esp], ecx	13_2_00453AD3
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00456B50 push eax; mov dword ptr [esp], ecx	13_2_00456B53
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_00454EB0 push eax; mov dword ptr [esp], ecx	13_2_00454EB3

Source: 8cccbf84c3e089418139dd95981f2766.tmp.6.dr

Static PE information: section name: .text entropy: 6.985757444463032

Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9DBC.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\4244ba815cc94a57841dfebadb3b6b17$dpx$.tmp\8cccbf84c3e089418139dd95981f2766.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\MSI9DBC.tmp

Jump to dropped file

Source: C:\Windows\SysWOW64\msiexec.exe

Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\." /SETINTEGRITYLEVEL (CI)(OI)HIGH

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Thread delayed: delay time: 600000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Thread delayed: delay time: 599983			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Window / User API: threadDelayed 516	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Window / User API: threadDelayed 1181	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Window / User API: threadDelayed 6150	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Window / User API: threadDelayed 1502	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Dropped PE file which has not been started: C:\Windows\Installer\MSI9DBC.tmp

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_13-70199

Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe TID: 5648	Thread sleep count: 516 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe TID: 5648	Thread sleep time: -309600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe TID: 5648	Thread sleep count: 1181 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe TID: 5648	Thread sleep count: 346 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe TID: 5648	Thread sleep count: 6150 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe TID: 5648	Thread sleep time: -599983s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe TID: 5648	Thread sleep count: 1502 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe TID: 5648	Thread sleep count: 39 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005C239E _free,_free,FindFirstFileExW,_free,		13_2_005C239E
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005C244F FindFirstFileExW,_free,FindNextFileW,_free,FindClose,_free,		13_2_005C244F

Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Thread delayed: delay time: 600000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Thread delayed: delay time: 599983			Jump to behavior

Source: anterra.exe, 0000000D.00000002.3429833371.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_13-69971

Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe

Code function: 13_2_005AC026 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

13_2_005AC026

Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005BFB86 mov eax, dword ptr fs:[00000030h]	13_2_005BFB86
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005B1598 mov eax, dword ptr fs:[00000030h]	13_2_005B1598
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005BFB55 mov eax, dword ptr fs:[00000030h]	13_2_005BFB55

Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe

Code function: 13_2_0047F760 GetProcessHeap,HeapFree,

13_2_0047F760

Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005AC026 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_005AC026
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005ABD8B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_005ABD8B
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: 13_2_005B3DAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_005B3DAA

Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\." /SETINTEGRITYLEVEL (CI)(OI)HIGH	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\expand.exe "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe "C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe" /VERYSILENT /VERYSILENT	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe

Code function: 13_2_005ABDB3 cpuid

13_2_005ABDB3

Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: GetLocaleInfoW,	13_2_005BD093
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: EnumSystemLocalesW,	13_2_005BD66D
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	13_2_005C16B7
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: EnumSystemLocalesW,	13_2_005C190D
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	13_2_005C19A8
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: EnumSystemLocalesW,	13_2_005C1BFB
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: GetLocaleInfoW,	13_2_005C1C5A
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: GetLocaleInfoW,	13_2_005C1D7A
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: EnumSystemLocalesW,	13_2_005C1D2F
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	13_2_005C1E21
Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe	Code function: GetLocaleInfoW,	13_2_005C1F27

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe

Code function: 13_2_005AC848 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

13_2_005AC848

Source: C:\Windows\SysWOW64\expand.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Native API	1 Services File Permissions Weakness	11 Process Injection	2 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Services File Permissions Weakness	121 Virtualization/Sandbox Evasion	LSASS Memory	221 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	121 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Services File Permissions Weakness	Cached Domain Credentials	11 Peripheral Device Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	3 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	34 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2Wr5r2e9vo.msi	29%	Virustotal		Browse
2Wr5r2e9vo.msi	29%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\4244ba815cc94a57841dfebadb3b6b17$dpx$.tmp\8cccbf84c3e089418139dd95981f2766.tmp	32%	ReversingLabs	Win32.Worm.Zomon
C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe (copy)	32%	ReversingLabs	Win32.Worm.Zomon
C:\Windows\Installer\MSI9DBC.tmp	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
keoqiqigggqkcykq.xyz	12%	Virustotal	Browse
uwgicagyykoommga.xyz	4%	Virustotal	Browse
oqsakkimkesccikc.xyz	5%	Virustotal	Browse
maoeeogmuauywsyu.xyz	4%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://keoqiqigggqkcykq.xyz:443/api/client_hello	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
keoqiqigggqkcykq.xyz	31.192.232.92	true	true	12%, Virustotal, Browse	unknown
ax-0001.ax-msedge.net	150.171.28.10	true	false		high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false		high
oqsakkimkesccikc.xyz	unknown	unknown	true	5%, Virustotal, Browse	unknown
uwgicagyykoommga.xyz	unknown	unknown	true	4%, Virustotal, Browse	unknown
maoeeogmuauywsyu.xyz	unknown	unknown	true	4%, Virustotal, Browse	unknown
wgyimykogekgewoa.xyz	unknown	unknown	true		unknown
uowgcyqcgaqiumoi.xyz	unknown	unknown	true		unknown
aqaqgemescmwsqks.xyz	unknown	unknown	true		unknown
gaisoawuoicqsumy.xyz	unknown	unknown	true		unknown
wuokiysmiucoucak.xyz	unknown	unknown	true		unknown
omasqkwqyskcagwi.xyz	unknown	unknown	true		unknown
aikmouciiqgecoqi.xyz	unknown	unknown	true		unknown
ikoqkscwsowwukmi.xyz	unknown	unknown	true		unknown
ymqaaskiwomkucuy.xyz	unknown	unknown	true		unknown
qiyggmguowygeooc.xyz	unknown	unknown	true		unknown
cogsyycsuwoysugi.xyz	unknown	unknown	true		unknown
akueuaicusaoieiy.xyz	unknown	unknown	true		unknown
yyimcoiwgckeakcm.xyz	unknown	unknown	true		unknown
cuccygameukkeumw.xyz	unknown	unknown	true		unknown
uymiagmwmqmimewm.xyz	unknown	unknown	true		unknown
cyyukyomsoiqyyqa.xyz	unknown	unknown	true		unknown
wgswkwaesqqwkoaa.xyz	unknown	unknown	true		unknown
cykgmsqcgysgaioo.xyz	unknown	unknown	true		unknown
sauygqecsusickcu.xyz	unknown	unknown	true		unknown
uokqeaieowiogsgc.xyz	unknown	unknown	true		unknown
mmeuqmoaekswggoe.xyz	unknown	unknown	true		unknown
ssoqscyewimqiqme.xyz	unknown	unknown	true		unknown
sesyieaiesegeaow.xyz	unknown	unknown	true		unknown
wssaqmakumewmaes.xyz	unknown	unknown	true		unknown
quoqoooiamqkkosc.xyz	unknown	unknown	true		unknown
ssegwgieumyoasym.xyz	unknown	unknown	true		unknown
eqyyguuwsyqaqgsq.xyz	unknown	unknown	true		unknown
yqcakkmwigkaumii.xyz	unknown	unknown	true		unknown
osaeyoiqoqawauga.xyz	unknown	unknown	true		unknown
kqmsgskwgemyueya.xyz	unknown	unknown	true		unknown
oekyamueeiiousia.xyz	unknown	unknown	true		unknown
ywkamsiogkycyosy.xyz	unknown	unknown	true		unknown
kigcewceemkckeow.xyz	unknown	unknown	true		unknown
qgukewuuykmmkgeq.xyz	unknown	unknown	true		unknown
seoomaqwwimwueiw.xyz	unknown	unknown	true		unknown
ismqaewykmoiguki.xyz	unknown	unknown	true		unknown
ekcwemuekgqsimae.xyz	unknown	unknown	true		unknown
iyaikmkkowcqemsi.xyz	unknown	unknown	true		unknown
keykoekseemyiewq.xyz	unknown	unknown	true		unknown
mywaqkeaawisisky.xyz	unknown	unknown	true		unknown
smckcsaioceiyasu.xyz	unknown	unknown	true		unknown
ieikmuieoqqmugwu.xyz	unknown	unknown	true		unknown
uoeeuiaewmogugeo.xyz	unknown	unknown	true		unknown
kcyakwisycecaqgw.xyz	unknown	unknown	true		unknown
eqmeimmouegoasay.xyz	unknown	unknown	true		unknown
ymysimqoykwqeqiq.xyz	unknown	unknown	true		unknown
skgcsksqyekiymii.xyz	unknown	unknown	true		unknown
mssaogwocegysoow.xyz	unknown	unknown	true		unknown
miigookwguakmkeu.xyz	unknown	unknown	true		unknown
auowmussgaesgwas.xyz	unknown	unknown	true		unknown
qigcqiaomwieqwka.xyz	unknown	unknown	true		unknown
oywgqkusocouysua.xyz	unknown	unknown	true		unknown
isaeicumkcuwqmqq.xyz	unknown	unknown	true		unknown
ukmcqucewskcqygg.xyz	unknown	unknown	true		unknown
omuquowgiusiesgk.xyz	unknown	unknown	true		unknown
skekiggeimmceqcg.xyz	unknown	unknown	true		unknown
wgcaouuqqqwucogy.xyz	unknown	unknown	true		unknown
cykgucwkesokooyw.xyz	unknown	unknown	true		unknown
iagisciiyoemgwaa.xyz	unknown	unknown	true		unknown
ecacmycegqoaquio.xyz	unknown	unknown	true		unknown
ywqiciegywcouoiy.xyz	unknown	unknown	true		unknown
ykeaoyaycoiamqey.xyz	unknown	unknown	true		unknown
gwwcqeykmseicgaw.xyz	unknown	unknown	true		unknown
yquocucuqoywwcsu.xyz	unknown	unknown	true		unknown
uoeiymqawsqiyuck.xyz	unknown	unknown	true		unknown
oqummowmqwcgsegm.xyz	unknown	unknown	true		unknown
ikwyooieywakeqog.xyz	unknown	unknown	true		unknown
ukekykoqskumoikg.xyz	unknown	unknown	true		unknown
uwimwwicgcscuoku.xyz	unknown	unknown	true		unknown
cseksqccmgaieyic.xyz	unknown	unknown	true		unknown
gmmacaiigwcscggs.xyz	unknown	unknown	true		unknown
miacggmycyqikoyq.xyz	unknown	unknown	true		unknown
ywyawywiuyecuiuu.xyz	unknown	unknown	true		unknown
qascmswkaisogoaq.xyz	unknown	unknown	true		unknown
mmisquwegymayaee.xyz	unknown	unknown	true		unknown
seuuicaewuoaumes.xyz	unknown	unknown	true		unknown
aoosomigeaiewqom.xyz	unknown	unknown	true		unknown
suwkomiqcykeyako.xyz	unknown	unknown	true		unknown
ysiwwoeeaaskykaw.xyz	unknown	unknown	true		unknown
qusmiuqmmgqsgeci.xyz	unknown	unknown	true		unknown
ggicikyqcaiyguee.xyz	unknown	unknown	true		unknown
uowowiqiyeiuwmcc.xyz	unknown	unknown	true		unknown
gwoyamckoqoaauoq.xyz	unknown	unknown	true		unknown
wuusiiukmwcmimyk.xyz	unknown	unknown	true		unknown
keosqeosukqcooco.xyz	unknown	unknown	true		unknown
oyewqwkusieeoqey.xyz	unknown	unknown	true		unknown
iqmeccigieosgmwq.xyz	unknown	unknown	true		unknown
eqkkkcuwkiqiecac.xyz	unknown	unknown	true		unknown
qiqueqokwqqgwwci.xyz	unknown	unknown	true		unknown
okkyekwuommcicqi.xyz	unknown	unknown	true		unknown
quuemeewaqaiiyqc.xyz	unknown	unknown	true		unknown
eigkgwkyuqssgamw.xyz	unknown	unknown	true		unknown
keguuyioweymiaws.xyz	unknown	unknown	true		unknown
goeykqccmemkswom.xyz	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://keoqiqigggqkcykq.xyz:443/api/client_hello	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
31.192.232.92	keoqiqigggqkcykq.xyz	Russian Federation		43948	GLESYS-ASSE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562073
Start date and time:	2024-11-25 07:41:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2Wr5r2e9vo.msi renamed because original name is a hash value
Original Sample Name:	8ef787b0f11fcb0d5d9fe3b209bb5526.msi
Detection:	MAL
Classification:	mal88.troj.evad.winMSI@12/12@342/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 79% Number of executed functions: 22 Number of non-executed functions: 129
Cookbook Comments:	Found application associated with file extension: .msi Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.109
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, tse1.mm.bing.net, g.bing.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, fe3cr.delivery.mp.microsoft.com, ris.api.iris.microsoft.com, ocsp.digicert.com, e16604.g.akamaiedge.net, ocsp.edge.digicert.com, prod.fs.microsoft.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.

Simulations

Behavior and APIs

Time	Type	Description
01:42:37	API Interceptor	494587x Sleep call for process: anterra.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
31.192.232.92	aba5298f.msi	Get hash	malicious	Unknown	Browse
31.192.232.92	setup.msi	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	file.exe	Get hash	malicious	Credential Flusher	Browse	192.229.221.95
	file.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	Outstanding Invoices_pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	192.229.221.95
	ListaItensVistoriaCorpodeBombeirosObrigatorio.msi	Get hash	malicious	AteraAgent	Browse	192.229.221.95
	registration.msi	Get hash	malicious	AteraAgent	Browse	192.229.221.95
	portal.msi	Get hash	malicious	AteraAgent	Browse	192.229.221.95
	Digital.msi	Get hash	malicious	AteraAgent	Browse	192.229.221.95
	file_66efd0132ceed.msi	Get hash	malicious	AteraAgent	Browse	192.229.221.95
	Guidelines_for_Citizen_Safety.msi	Get hash	malicious	AteraAgent	Browse	192.229.221.95
	e0#U05ea.msi	Get hash	malicious	AteraAgent	Browse	192.229.221.95
ax-0001.ax-msedge.net	RFQ AE 3003910999.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	150.171.27.10
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10
	file.exe	Get hash	malicious	Stealc	Browse	150.171.27.10
	file.exe	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	Stealc	Browse	150.171.27.10
	file.exe	Get hash	malicious	Stealc	Browse	150.171.28.10
	lw2HMxuVuf.exe	Get hash	malicious	Unknown	Browse	150.171.27.10
	17324340651fd0721b4a9b07278d0f63e6333ccd4883a9dc52eb27994b32b0d64dfb919b72906.dat-decoded.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	150.171.28.10
	ORDER 08757646566535857_95877465434-1.exe	Get hash	malicious	FormBook	Browse	150.171.28.10
	file.exe	Get hash	malicious	Stealc	Browse	150.171.27.10

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GLESYS-ASSE	aba5298f.msi	Get hash	malicious	Unknown	Browse	31.192.232.92
	setup.msi	Get hash	malicious	Unknown	Browse	31.192.232.92
	byte.mpsl.elf	Get hash	malicious	Okiru	Browse	79.99.1.65
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	194.132.103.241
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	194.132.75.40
	na.elf	Get hash	malicious	Unknown	Browse	194.132.75.55
	PrintDriver_x64.msi	Get hash	malicious	Unknown	Browse	31.192.232.37
	xd.x86.elf	Get hash	malicious	Mirai	Browse	194.132.99.68
	rsJtZBgpwG.elf	Get hash	malicious	Mirai	Browse	194.132.75.41
	DocScan_20244841.js	Get hash	malicious	Unknown	Browse	31.192.232.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Installer\MSI9DBC.tmp	wE1inOhJA5.msi	Get hash	malicious	Remcos, RHADAMANTHYS	Browse
	wE1inOhJA5.msi	Get hash	malicious	Unknown	Browse
	EVp6NE5N9g.msi	Get hash	malicious	Unknown	Browse
	EVp6NE5N9g.msi	Get hash	malicious	Unknown	Browse
	aba5298f.msi	Get hash	malicious	Unknown	Browse
	aba5298f.msi	Get hash	malicious	Unknown	Browse
	fO7yt1oYdn.msi	Get hash	malicious	Unknown	Browse
	fO7yt1oYdn.msi	Get hash	malicious	Unknown	Browse
	fO7yt1oYdn.msi	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files.cab

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 1597944 bytes, 1 file, at 0x2c +A "anterra.exe", ID 28617, number 1, 20998 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1597944
Entropy (8bit):	5.284249670897271
Encrypted:	false
SSDEEP:	24576:3TnopGR274VCg0MOg44CGgRynfWMSrcJ/:spGR0ACg0MOWCwnuMacJ/
MD5:	3EA8F867C2DAD306173D24F0A0F1C763
SHA1:	E44EEF4FC152DC00C2AB01FF3042DFEC100BD37D
SHA-256:	33A956FD56612688E6339D4D4486E8767AAC967A2AC808EB9FAD1AF20B4AC9B6
SHA-512:	CB8F4DD7BA9789D4D19C038B6FBCD3412F7315381D56943BBE3C9BAD17F1C3BFBEF36E3E2564CA4FA0CAD3E0F4BEBF70EC93A2584DEC43B70D13ACC6B2A56680
Malicious:	false
Reputation:	low
Preview:	MSCF.....a......,................o..H....R.....)......uY<. .anterra.exe......>..[...6 6&q.....5..P..mN.V.V...&.R...Q..T..$\..C.....jB...C...{o.rV...h..oQ..Z5.Te#3.V...`{..I.J...<...5.x._\|...^.. (..ua.7_..sf;0\|3.t ..Q.@....-...G.+...Q...l.#E.u.o&)XT......QGl#.[N%.H..'1.#.,.....Z..D....F..........9{....]~j..w[.%....$WQ..X"I..H.(..+.8p.@.q....AEp.......e...Y...(...0.....?7E.....J.G..z..Oiq...+....H.7......oG.3.H.>.)>o....7..j[.M.&.{.h..{...............X='e._..dZ...\|.......J.A..cb><...2.C..Z....c(..S=...3.z..&U?. ..vh1..W....}.3..6.\|X..GM..\s..%.x....~...CD.FU..t...2!.f.b=...MTM.*..>..v......L..]5.kx....r.-..?...q.D.^.)..<...<....8./...9...0.....O)x...~.X..!..$2.y...[.....@.aL). ..d%Vl....0w.s.k)...Z}........O+.N..Q.pZ.../.....z....M.N..z.....y....K.~b<Q.8Y.Q)~..q....:.U.LZ...'+...A&..d.\|.3...#...7W=z......Hs.6K.h.X..'...B..H..a}.1B...3Y..&l.AN...,.g1P.p.'.x.1...L......'t...........-.....M0......".... ..N....L.....T.......a.....'..p6...GE]. ..Bor6.

C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\4244ba815cc94a57841dfebadb3b6b17$dpx$.tmp\8cccbf84c3e089418139dd95981f2766.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	688039936
Entropy (8bit):	0.042704478581080584
Encrypted:	false
SSDEEP:
MD5:	DF5B588DABBB47648D6FEF8ABBC59064
SHA1:	C9FDA90C3AB3E3328928B4E050252B2A82234CF0
SHA-256:	3283C6AB5E25F642C170C570EE170B893916BE8DB0BF7BB27158AF054AD84B5E
SHA-512:	BCF0688FBC5E1287F8AB52B745DFCAC8AB9E3B6267FD791E7724A2D8EB605B74A54F8CC3B97901EF59A85F4AE25FC96975265BEDB7DAEC96802AF1788E69212A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....?g............................5.............@..........................p......_..)..@.....................................x...........................................................+.......................................................text............................... ..`.rdata........... ..................@..@.data............>..................@....00cfg..............................@..@.tls................................@....voltbl.,................................rsrc..............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	688039936
Entropy (8bit):	0.042704478581080584
Encrypted:	false
SSDEEP:
MD5:	DF5B588DABBB47648D6FEF8ABBC59064
SHA1:	C9FDA90C3AB3E3328928B4E050252B2A82234CF0
SHA-256:	3283C6AB5E25F642C170C570EE170B893916BE8DB0BF7BB27158AF054AD84B5E
SHA-512:	BCF0688FBC5E1287F8AB52B745DFCAC8AB9E3B6267FD791E7724A2D8EB605B74A54F8CC3B97901EF59A85F4AE25FC96975265BEDB7DAEC96802AF1788E69212A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....?g............................5.............@..........................p......_..)..@.....................................x...........................................................+.......................................................text............................... ..`.rdata........... ..................@..@.data............>..................@....00cfg..............................@..@.tls................................@....voltbl.,................................rsrc..............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\msiwrapper.ini

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	3.6916431300316406
Encrypted:	false
SSDEEP:	48:LKAQQG/EnpZJFhZQ8GPZQ8Gk5SbZQ8GHA0ow:KQG/cpNQ8mQ8voNQ8B6
MD5:	EF003284489D4945615348903AD4E9A6
SHA1:	AC91A5649F4B7898F7421D96CD8F6D37254F16C3
SHA-256:	C2C51490787E311148586537B48E10C6CCBBC4CFA0B0DF90108FA5B1923B8921
SHA-512:	7739C119B0898C1D8DD5D2E6A9342FB42EBA4ED0CB17FA0D19341AFD39B661D0E0D3E9AF257BE8C649D69D518C7F8A17ABEBB7ED52582CAEF7AF41C073388B83
Malicious:	false
Preview:	W.r.a.p.p.e.d.A.p.p.l.i.c.a.t.i.o.n.I.d.=.G.o.o.g.l.e. .C.h.r.o.m.e...W.r.a.p.p.e.d.R.e.g.i.s.t.r.a.t.i.o.n.=.N.o.n.e...I.n.s.t.a.l.l.S.u.c.c.e.s.s.C.o.d.e.s.=.0...E.l.e.v.a.t.i.o.n.M.o.d.e.=.n.e.v.e.r...B.a.s.e.N.a.m.e.=.a.n.t.e.r.r.a...e.x.e...C.a.b.H.a.s.h.=.3.3.a.9.5.6.f.d.5.6.6.1.2.6.8.8.e.6.3.3.9.d.4.d.4.4.8.6.e.8.7.6.7.a.a.c.9.6.7.a.2.a.c.8.0.8.e.b.9.f.a.d.1.a.f.2.0.b.4.a.c.9.b.6...S.e.t.u.p.P.a.r.a.m.e.t.e.r.s.=./.V.E.R.Y.S.I.L.E.N.T. . ./.V.E.R.Y.S.I.L.E.N.T. ...W.o.r.k.i.n.g.D.i.r.=...C.u.r.r.e.n.t.D.i.r.=..S.O.U.R.C.E.D.I.R....U.I.L.e.v.e.l.=.5...F.o.c.u.s.=.y.e.s...S.e.s.s.i.o.n.D.i.r.=.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.M.W.-.f.7.6.4.9.0.c.4.-.b.9.0.5.-.4.3.6.a.-.b.b.a.f.-.3.3.2.9.b.c.8.4.a.e.5.f.\...F.i.l.e.s.D.i.r.=.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.M.W.-.f.7.6.4.9.0.c.4.-.b.9.0.5.-.4.3.6.a.-.b.b.a.f.-.3.3.2.9.b.c.8.4.a.e.5.f.\.f.i.l.e.s.\...R.u.n.B.e.f.o.r.e.I.n.s.t.a.l.l.F.i.l.e.=...R.u.n.

C:\Windows\Installer\3a9a03.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Google Chrome 131.0.6778.71, Subject: Google Chrome, Author: Google LLC, Keywords: Installer, Template: Intel;1033, Revision Number: {06E54237-1D3F-447A-902F-6205E6A68006}, Create Time/Date: Thu Jan 11 14:59:44 2024, Last Saved Time/Date: Thu Jan 11 14:59:44 2024, Number of Pages: 200, Number of Words: 12, Name of Creating Application: MSI Wrapper (11.0.53.0), Security: 2
Category:	dropped
Size (bytes):	1908736
Entropy (8bit):	5.605104857181301
Encrypted:	false
SSDEEP:	24576:Mt9cpVDhSsbTnopGR274VCg0MOg44CGgRynfWMSrcJ:rpRhSppGR0ACg0MOWCwnuMacJ
MD5:	8EF787B0F11FCB0D5D9FE3B209BB5526
SHA1:	E5F31BFE6F080679807333760F18281ABFD17ADC
SHA-256:	D66BDCB1C0A4F2E5452C852E24E001D153A9C9DE1D7A692CB5F1EDE5E056F1FA
SHA-512:	E492F1C086CAEF83EF92FD8AD8DC569A6EBE8A1D18499845B7CE2CB2DDDAED30BB193EE5F7FE581B67E838FEE81A8E689CD377E0053B201B2590FAFF796D00A0
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI9DBC.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	212992
Entropy (8bit):	6.513409725320959
Encrypted:	false
SSDEEP:	3072:xspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8:jtOdiRQYpgjpjew5DHyGxcqo8
MD5:	0C8921BBCC37C6EFD34FAF44CF3B0CB5
SHA1:	DCFA71246157EDCD09EECAF9D4C5E360B24B3E49
SHA-256:	FD622CF73EA951A6DE631063ABA856487D77745DD1500ADCA61902B8DDE56FE1
SHA-512:	ED55443E20D40CCA90596F0A0542FA5AB83FE0270399ADFAAFD172987FB813DFD44EC0DA0A58C096AF3641003F830341FE259AD5BCE9823F238AE63B7E11E108
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: wE1inOhJA5.msi, Detection: malicious, Browse Filename: wE1inOhJA5.msi, Detection: malicious, Browse Filename: EVp6NE5N9g.msi, Detection: malicious, Browse Filename: EVp6NE5N9g.msi, Detection: malicious, Browse Filename: aba5298f.msi, Detection: malicious, Browse Filename: aba5298f.msi, Detection: malicious, Browse Filename: fO7yt1oYdn.msi, Detection: malicious, Browse Filename: fO7yt1oYdn.msi, Detection: malicious, Browse Filename: fO7yt1oYdn.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............p...p...p.......p.....p..../.p.......p...q.%.p.......p.....p.....p.Rich..p.........................PE..L...Y..e...........!.....h..........K................................................]....@.........................P...]............P.......................`.....................................p...@...............t............................text....f.......h.................. ..`.rdata...............l..............@..@.data....5..........................@....rsrc........P......................@..@.reloc...)...`...*..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{D425ECE9-AA22-4FB8-9E95-B5A59C391C55}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7689374481732436
Encrypted:	false
SSDEEP:	12:JSbX72Fj4AGiLIlHVRpZh/7777777777777777777777777vDHFp+xit/l0i8Q:JKQI5tziF
MD5:	71F6816ADF0DA6F34490D002D94C30A1
SHA1:	38AE54E09D10ED7ABABE4E4E68EA4C7AC58C9EA7
SHA-256:	C3414A01E3FACDC0EEE7B916FFAC3B4DE1C940C62D591D2AE86533358968BCF6
SHA-512:	AA3022B649E38BBB2F712C788945C71601D7091BCD6D01A2E2FE30162E94078498FD866A5A7B4DE637D24F94E17E949D50C703621DAFF23F8862B174AF399D41
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.214039744312883
Encrypted:	false
SSDEEP:	48:yJquwPveFXJjT5sF5bj9ddSPhrTddSBWr1l:yqQ7TmFYq
MD5:	DE73A911516D7C2F5BD928B08E75BED2
SHA1:	850F2D21B97CAC30AA4058D66984B4CB97482981
SHA-256:	E7838F54780DDEC99088D8955F401D01044E34BBEB0139F6AFD3B096A7335031
SHA-512:	6AD7199A31DC0DD8AC5F91C7CA9976EA70C1D8BFC1E52C23B35B393BAE80720BA90BFF1974E9385B20FD614FAC8B85F215D18107D08C708B56F389D5FA90C56C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	360001
Entropy (8bit):	5.362990021074007
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauO:zTtbmkExhMJCIpEj
MD5:	1C198C68DA4024E1D831E1F119A6BACE
SHA1:	14F3A61BDF918017618E3F6F2E7761CCCF25B0B6
SHA-256:	387C52EF402BB0DCEA0BFCDDAB7B6EC6F8507099EA58CB3FE14FE92F4DCE693E
SHA-512:	97703420A1DAC20CDA21886FE75B87F3E0D0A6121DEE31A8FFA555513739D65B433EDAAFCB30C525A3B78DDF21FEF19DFDF07C946CE033BCDC1CA823D2F4E456
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DFCF734CD0CE30AA3D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	0.10586990789776925
Encrypted:	false
SSDEEP:	24:JKBT0xJfAebfddipV7kddipVdVgwG8lrkg9S/jI+kMqoo:JQgrfddSBkddSPhrkjIzo
MD5:	B2F15660D657F52DE53A81F94C50555A
SHA1:	CF2E97C5DB8BDFFFB07B2B23CF8E8504AA2954A9
SHA-256:	A60FAF39E617402337B743FE07ECB69FB73155AE32801F341C2F76CE62C84410
SHA-512:	7B6F0688B08EFA28014D3A44F2ECB8DF188473E9C2580B6FD1785FAEE411C66A573C07C651034F2BF0ED18DA82831233DF5A4289566D8E02C1F39D6F643F17CE
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFDBE736A01738D6FA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07120220492646537
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOlz+Nq1tgVky6lit/:2F0i8n0itFzDHFp+eit/
MD5:	2DE8AA152F1A278709C6E038966AE283
SHA1:	6F4C863CC2271413575D8393E5D69E67B18DAECC
SHA-256:	B63CD55045B77AB9D532C303542AE0BB67C2BE19360A03B7C5CEA7028C203439
SHA-512:	89C2B4D07155E034907924DE7A67246309D7192CE1C9ED16B1DA670E329EDEF0795D1FCD07A81411F18352245595D18837A945137CA1DBA3FD9072C188483BA9
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	ASCII text, with very long lines (1014), with CRLF, CR, LF line terminators, with overstriking
Category:	dropped
Size (bytes):	1215
Entropy (8bit):	3.511303508221948
Encrypted:	false
SSDEEP:	24:zKcND5QDdXXXXXXXXXXXXXXXXXXXeDYJQn:zKaDK5XXXXXXXXXXXXXXXXXXXe9
MD5:	F710BD181859C3BEA6DC9FA882A0581B
SHA1:	7A8592DE63744E390FA43D05C96B43111830B29D
SHA-256:	18B97DC6E2A9B353374CA281EA9E60C213F740E9E935EBF7758280DB62895273
SHA-512:	C9D4A47CD4E6D6C4FA93D3E55F7869F7D8B300E4BC5E89862ADF460473A18033BC1199EBE2C2459E6CA1326CF73097A254EB5F0F5ED01E8F310EF002282A4203
Malicious:	false
Preview:	Microsoft (R) File Expansion Utility..Copyright (c) Microsoft Corporation. All rights reserved.....Adding files\anterra.exe to Extraction Queue....Expanding Files ......Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files.........................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Google Chrome 131.0.6778.71, Subject: Google Chrome, Author: Google LLC, Keywords: Installer, Template: Intel;1033, Revision Number: {06E54237-1D3F-447A-902F-6205E6A68006}, Create Time/Date: Thu Jan 11 14:59:44 2024, Last Saved Time/Date: Thu Jan 11 14:59:44 2024, Number of Pages: 200, Number of Words: 12, Name of Creating Application: MSI Wrapper (11.0.53.0), Security: 2
Entropy (8bit):	5.605104857181301
TrID:	Generic OLE2 / Multistream Compound File (8008/1) 100.00%
File name:	2Wr5r2e9vo.msi
File size:	1'908'736 bytes
MD5:	8ef787b0f11fcb0d5d9fe3b209bb5526
SHA1:	e5f31bfe6f080679807333760f18281abfd17adc
SHA256:	d66bdcb1c0a4f2e5452c852e24e001d153a9c9de1d7a692cb5f1ede5e056f1fa
SHA512:	e492f1c086caef83ef92fd8ad8dc569a6ebe8a1d18499845b7ce2cb2dddaed30bb193ee5f7fe581b67e838fee81a8e689cd377e0053b201b2590faff796d00a0
SSDEEP:	24576:Mt9cpVDhSsbTnopGR274VCg0MOg44CGgRynfWMSrcJ:rpRhSppGR0ACg0MOWCwnuMacJ
TLSH:	F29545D13785C127E9470C314E97C399A72AFCE5AA30B08B77A0B71E5B399D36E25312
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 07:42:44.411829948 CET	49797	443	192.168.2.6	31.192.232.92
Nov 25, 2024 07:42:44.411861897 CET	443	49797	31.192.232.92	192.168.2.6
Nov 25, 2024 07:42:44.411928892 CET	49797	443	192.168.2.6	31.192.232.92
Nov 25, 2024 07:42:44.412733078 CET	49797	443	192.168.2.6	31.192.232.92
Nov 25, 2024 07:42:44.412748098 CET	443	49797	31.192.232.92	192.168.2.6
Nov 25, 2024 07:42:44.412789106 CET	443	49797	31.192.232.92	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 07:42:43.464306116 CET	63106	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:43.876997948 CET	53	63106	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:43.880501032 CET	57318	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:44.405325890 CET	53	57318	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:44.413459063 CET	62569	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:44.663211107 CET	53	62569	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:44.664470911 CET	52320	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:44.908363104 CET	53	52320	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:44.909230947 CET	56999	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:45.143069029 CET	53	56999	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:45.155025959 CET	56542	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:45.772722006 CET	53	56542	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:45.823261023 CET	62722	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:46.057715893 CET	53	62722	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:46.182852030 CET	54225	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:46.417078972 CET	53	54225	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:46.417956114 CET	57728	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:46.652769089 CET	53	57728	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:46.653711081 CET	58168	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:46.880230904 CET	53	58168	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:46.881192923 CET	51467	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:47.108027935 CET	53	51467	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:47.108850956 CET	50954	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:47.419380903 CET	53	50954	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:47.420420885 CET	52407	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:47.734921932 CET	53	52407	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:47.736210108 CET	54226	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:47.975377083 CET	53	54226	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:47.976500988 CET	60621	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:48.209748030 CET	53	60621	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:48.210808039 CET	49233	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:48.461339951 CET	53	49233	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:48.463329077 CET	65285	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:48.772095919 CET	53	65285	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:48.791054010 CET	57525	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:49.026596069 CET	53	57525	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:49.310750008 CET	54074	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:49.621525049 CET	53	54074	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:49.623070955 CET	58456	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:49.860989094 CET	53	58456	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:49.862099886 CET	63089	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:50.175507069 CET	53	63089	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:50.176597118 CET	62169	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:50.486675978 CET	53	62169	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:50.487739086 CET	63420	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:50.805180073 CET	53	63420	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:50.806289911 CET	56982	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:51.117918968 CET	53	56982	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:51.119014025 CET	57017	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:51.357064962 CET	53	57017	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:51.358179092 CET	64091	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:51.593477011 CET	53	64091	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:51.594341993 CET	59791	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:51.823498964 CET	53	59791	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:51.824454069 CET	65033	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:52.054591894 CET	53	65033	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:52.076585054 CET	58996	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:52.314260006 CET	53	58996	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:52.315563917 CET	57162	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:52.628350019 CET	53	57162	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:52.629292965 CET	51599	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:52.860569000 CET	53	51599	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:52.861469030 CET	56397	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:53.101443052 CET	53	56397	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:53.102334976 CET	55925	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:53.328497887 CET	53	55925	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:53.329421997 CET	54461	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:53.637305975 CET	53	54461	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:53.638227940 CET	49153	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:53.892999887 CET	53	49153	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:53.893789053 CET	52520	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:54.213109970 CET	53	52520	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:54.214035034 CET	56533	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:54.833137989 CET	53	56533	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:54.834059000 CET	60097	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:55.152791977 CET	53	60097	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:55.153644085 CET	54028	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:55.402666092 CET	53	54028	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:55.403769016 CET	62662	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:55.640198946 CET	53	62662	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:55.641443014 CET	58350	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:55.879942894 CET	53	58350	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:55.880984068 CET	49995	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:56.130148888 CET	53	49995	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:56.131288052 CET	50635	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:56.359009027 CET	53	50635	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:56.360151052 CET	53233	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:56.582168102 CET	53	53233	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:56.583225012 CET	61376	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:56.812673092 CET	53	61376	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:56.813731909 CET	63092	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:57.048571110 CET	53	63092	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:57.049815893 CET	57046	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:57.368793964 CET	53	57046	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:57.369887114 CET	64738	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:57.681859970 CET	53	64738	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:57.683021069 CET	58452	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:57.923152924 CET	53	58452	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:57.924798012 CET	61680	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:58.160433054 CET	53	61680	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:58.161421061 CET	62404	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:58.387115955 CET	53	62404	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:58.388288021 CET	55903	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:58.700515985 CET	53	55903	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:58.701956987 CET	63121	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:58.938034058 CET	53	63121	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:58.939502954 CET	57164	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:59.176297903 CET	53	57164	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:59.177403927 CET	60369	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:59.402385950 CET	53	60369	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:59.403347015 CET	58835	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:59.638278961 CET	53	58835	1.1.1.1	192.168.2.6
Nov 25, 2024 07:42:59.639667988 CET	59539	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:42:59.952807903 CET	53	59539	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:00.028580904 CET	51158	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:00.263302088 CET	53	51158	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:00.294835091 CET	60102	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:00.525245905 CET	53	60102	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:00.549355030 CET	53407	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:00.807523012 CET	53	53407	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:00.808516979 CET	59709	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:01.048680067 CET	53	59709	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:01.050117016 CET	56525	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:01.295047045 CET	53	56525	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:01.295974970 CET	52120	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:01.537347078 CET	53	52120	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:01.538409948 CET	61809	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:01.856120110 CET	53	61809	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:01.860862017 CET	61789	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:02.173403978 CET	53	61789	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:02.177170038 CET	56908	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:02.414078951 CET	53	56908	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:02.415323019 CET	51391	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:02.651428938 CET	53	51391	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:02.652218103 CET	59265	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:02.900804043 CET	53	59265	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:02.902115107 CET	61722	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:03.216351986 CET	53	61722	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:03.219548941 CET	55522	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:03.472306967 CET	53	55522	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:03.507993937 CET	54381	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:03.760411978 CET	53	54381	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:03.800121069 CET	63645	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:04.115869999 CET	53	63645	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:04.116976023 CET	59168	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:04.345221043 CET	53	59168	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:04.346290112 CET	58096	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:04.570444107 CET	53	58096	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:04.571490049 CET	56397	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:04.815239906 CET	53	56397	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:04.816287041 CET	50753	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:05.062884092 CET	53	50753	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:05.064374924 CET	60003	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:05.373590946 CET	53	60003	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:05.374727011 CET	57600	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:05.620500088 CET	53	57600	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:05.621646881 CET	55339	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:05.845906973 CET	53	55339	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:05.846971989 CET	64053	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:06.072746992 CET	53	64053	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:06.073775053 CET	54959	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:06.327953100 CET	53	54959	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:06.329042912 CET	61007	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:06.571243048 CET	53	61007	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:06.572308064 CET	59461	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:06.881623983 CET	53	59461	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:06.882637024 CET	51173	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:07.122221947 CET	53	51173	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:07.123203039 CET	51562	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:07.359385014 CET	53	51562	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:07.360481977 CET	58635	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:07.597616911 CET	53	58635	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:07.598690033 CET	55600	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:07.838146925 CET	53	55600	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:07.839215994 CET	55284	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:08.081338882 CET	53	55284	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:08.082452059 CET	58059	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:08.329633951 CET	53	58059	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:08.330746889 CET	52987	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:08.575721025 CET	53	52987	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:08.580909014 CET	64746	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:08.809726000 CET	53	64746	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:08.810751915 CET	50292	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:09.035053968 CET	53	50292	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:09.036112070 CET	59662	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:09.347517014 CET	53	59662	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:09.348423958 CET	64332	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:09.596386909 CET	53	64332	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:09.597450018 CET	50294	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:09.827820063 CET	53	50294	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:09.828943968 CET	55747	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:10.081800938 CET	53	55747	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:10.083009958 CET	60917	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:10.393402100 CET	53	60917	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:10.394516945 CET	51096	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:10.705668926 CET	53	51096	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:10.706979990 CET	57815	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:10.947154999 CET	53	57815	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:10.948496103 CET	55958	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:11.187079906 CET	53	55958	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:11.188294888 CET	50000	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:11.425141096 CET	53	50000	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:11.426316977 CET	64931	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:11.665942907 CET	53	64931	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:11.674643040 CET	61270	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:11.917234898 CET	53	61270	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:11.918459892 CET	56468	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:12.149837017 CET	53	56468	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:12.151550055 CET	57008	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:12.391664982 CET	53	57008	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:12.441626072 CET	52853	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:12.894018888 CET	53	52853	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:12.947151899 CET	51213	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:13.181128025 CET	53	51213	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:13.182254076 CET	51832	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:13.417880058 CET	53	51832	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:13.419017076 CET	50590	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:13.647361040 CET	53	50590	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:13.648360968 CET	52605	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:13.874398947 CET	53	52605	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:13.875338078 CET	58667	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:14.116621017 CET	53	58667	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:14.117770910 CET	58301	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:14.431859970 CET	53	58301	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:14.433605909 CET	50233	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:14.673240900 CET	53	50233	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:14.674534082 CET	53790	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:14.923985958 CET	53	53790	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:14.925183058 CET	56247	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:15.234641075 CET	53	56247	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:15.235819101 CET	55187	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:15.460077047 CET	53	55187	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:15.461658001 CET	52609	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:15.706433058 CET	53	52609	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:15.771589041 CET	60600	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:15.998867989 CET	53	60600	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:16.138097048 CET	58162	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:16.453465939 CET	53	58162	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:16.454595089 CET	54483	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:16.693351030 CET	53	54483	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:16.694472075 CET	61459	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:17.006175041 CET	53	61459	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:17.007237911 CET	55038	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:17.239398956 CET	53	55038	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:17.240540028 CET	59142	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:17.551119089 CET	53	59142	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:17.552164078 CET	51941	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:17.864094019 CET	53	51941	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:17.865415096 CET	51271	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:18.098277092 CET	53	51271	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:18.099334002 CET	63969	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:18.335284948 CET	53	63969	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:18.336313009 CET	50396	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:19.057938099 CET	53	50396	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:19.124227047 CET	54462	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:19.352587938 CET	53	54462	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:19.353621960 CET	63915	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:19.663105965 CET	53	63915	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:19.664093971 CET	60674	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:19.909269094 CET	53	60674	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:19.910269976 CET	54905	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:20.224685907 CET	53	54905	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:20.225688934 CET	57199	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:20.462007999 CET	53	57199	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:20.463166952 CET	54592	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:20.690298080 CET	53	54592	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:20.691302061 CET	56392	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:20.922532082 CET	53	56392	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:20.923909903 CET	50239	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:21.239236116 CET	53	50239	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:21.240528107 CET	55835	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:21.484021902 CET	53	55835	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:21.485487938 CET	54540	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:21.716784000 CET	53	54540	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:21.776146889 CET	51522	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:22.007155895 CET	53	51522	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:22.162096024 CET	49779	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:22.380822897 CET	53	49779	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:22.504165888 CET	60061	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:22.750464916 CET	53	60061	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:22.753050089 CET	57930	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:22.988456964 CET	53	57930	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:22.989537954 CET	61719	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:23.231245995 CET	53	61719	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:23.232347012 CET	50821	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:23.546083927 CET	53	50821	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:23.547350883 CET	52191	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:23.856034994 CET	53	52191	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:23.857249975 CET	58537	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:24.166810989 CET	53	58537	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:24.168231964 CET	56761	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:24.413969994 CET	53	56761	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:24.415196896 CET	55072	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:24.658035994 CET	53	55072	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:24.663361073 CET	61163	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:24.901818037 CET	53	61163	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:24.915460110 CET	59271	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:25.151554108 CET	53	59271	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:25.246970892 CET	62684	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:25.559406996 CET	53	62684	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:25.568589926 CET	51782	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:25.813433886 CET	53	51782	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:25.814660072 CET	54795	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:26.043581963 CET	53	54795	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:26.044840097 CET	50630	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:26.358818054 CET	53	50630	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:26.360003948 CET	53857	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:26.597244024 CET	53	53857	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:26.598427057 CET	54823	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:26.823875904 CET	53	54823	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:26.825088024 CET	55991	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:27.057318926 CET	53	55991	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:27.058423042 CET	57150	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:27.301233053 CET	53	57150	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:27.302445889 CET	61235	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:27.535701036 CET	53	61235	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:27.536880016 CET	56059	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:27.849803925 CET	53	56059	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:27.851097107 CET	56226	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:28.107491016 CET	53	56226	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:28.130888939 CET	63876	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:28.364573002 CET	53	63876	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:28.417211056 CET	58315	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:28.729388952 CET	53	58315	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:28.768594980 CET	50218	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:29.008758068 CET	53	50218	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:29.009864092 CET	50060	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:29.318506002 CET	53	50060	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:29.320116043 CET	62880	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:29.630239010 CET	53	62880	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:29.631831884 CET	54053	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:29.944799900 CET	53	54053	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:29.949266911 CET	57670	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:30.200145006 CET	53	57670	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:30.201216936 CET	53069	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:30.436234951 CET	53	53069	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:30.437370062 CET	59369	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:30.660789013 CET	53	59369	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:30.661936998 CET	63603	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:30.901300907 CET	53	63603	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:30.907953024 CET	62820	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:31.147852898 CET	53	62820	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:31.158586025 CET	52609	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:31.385229111 CET	53	52609	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:31.399908066 CET	60132	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:31.636288881 CET	53	60132	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:31.645375967 CET	65301	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:31.873076916 CET	53	65301	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:31.905848026 CET	60934	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:32.144113064 CET	53	60934	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:32.145226955 CET	51300	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:32.377203941 CET	53	51300	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:32.378634930 CET	55826	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:32.688980103 CET	53	55826	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:32.691608906 CET	53366	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:32.924922943 CET	53	53366	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:32.926363945 CET	49614	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:33.156320095 CET	53	49614	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:33.164741993 CET	64939	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:33.394998074 CET	53	64939	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:33.396120071 CET	50600	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:33.709239006 CET	53	50600	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:33.710397005 CET	64761	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:33.949033022 CET	53	64761	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:33.950059891 CET	65455	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:34.265642881 CET	53	65455	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:34.318192005 CET	60111	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:34.549222946 CET	53	60111	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:34.558356047 CET	55767	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:34.872266054 CET	53	55767	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:34.965249062 CET	55767	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:35.063849926 CET	55368	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:35.102586985 CET	53	55767	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:35.301449060 CET	53	55368	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:35.302622080 CET	58081	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:35.527666092 CET	53	58081	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:35.528698921 CET	62430	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:35.837469101 CET	53	62430	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:35.838460922 CET	63377	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:36.083643913 CET	53	63377	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:36.086256027 CET	61152	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:36.318451881 CET	53	61152	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:36.319363117 CET	53272	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:36.552597046 CET	53	53272	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:36.553515911 CET	57071	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:36.923939943 CET	57071	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:37.045686007 CET	53	57071	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:37.046767950 CET	49255	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:37.061218977 CET	53	57071	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:37.273227930 CET	53	49255	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:37.274560928 CET	63856	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:37.501923084 CET	53	63856	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:37.510082960 CET	51441	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:37.741780043 CET	53	51441	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:37.785758018 CET	62062	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:38.025662899 CET	53	62062	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:38.043611050 CET	53793	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:38.274369001 CET	53	53793	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:38.275501013 CET	49382	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:38.499217987 CET	53	49382	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:38.500360966 CET	63458	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:38.750020981 CET	53	63458	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:38.751029015 CET	62188	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:38.992010117 CET	53	62188	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:38.994399071 CET	53604	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:39.242861986 CET	53	53604	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:39.244103909 CET	55298	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:39.482786894 CET	53	55298	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:39.483690977 CET	51927	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:39.791871071 CET	53	51927	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:39.792783976 CET	58132	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:40.016211033 CET	53	58132	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:40.017148018 CET	52797	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:40.265794992 CET	53	52797	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:40.266743898 CET	64554	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:40.505139112 CET	53	64554	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:40.506114006 CET	63123	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:40.757111073 CET	53	63123	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:40.757960081 CET	62217	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:41.012825966 CET	53	62217	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:41.013824940 CET	61606	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:41.329078913 CET	53	61606	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:41.329997063 CET	49193	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:41.561973095 CET	53	49193	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:41.562891006 CET	51202	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:41.886334896 CET	53	51202	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:41.887166977 CET	62824	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:42.127613068 CET	53	62824	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:42.128591061 CET	65512	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:42.368663073 CET	53	65512	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:42.370120049 CET	57384	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:42.606513023 CET	53	57384	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:42.617572069 CET	52128	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:42.851171970 CET	53	52128	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:42.906753063 CET	56873	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:43.132482052 CET	53	56873	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:43.169754982 CET	64110	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:43.388155937 CET	53	64110	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:43.388984919 CET	58697	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:43.627223969 CET	53	58697	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:43.628256083 CET	61003	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:43.848531008 CET	53	61003	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:43.849431992 CET	60506	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:44.101416111 CET	53	60506	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:44.102257967 CET	65198	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:44.343830109 CET	53	65198	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:44.344846964 CET	53043	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:44.654449940 CET	53	53043	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:44.655431986 CET	61612	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:44.969511032 CET	53	61612	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:44.970592022 CET	60314	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:45.281018972 CET	53	60314	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:45.281968117 CET	55418	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:45.514971018 CET	53	55418	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:45.516151905 CET	55164	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:45.826637030 CET	53	55164	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:45.841872931 CET	49579	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:46.063884974 CET	53	49579	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:46.084501028 CET	64411	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:46.331485033 CET	53	64411	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:46.397847891 CET	63863	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:46.632798910 CET	53	63863	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:46.633690119 CET	52090	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:46.886451006 CET	53	52090	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:46.887439966 CET	54827	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:47.197211981 CET	53	54827	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:47.198232889 CET	52605	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:47.509733915 CET	53	52605	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:47.510571957 CET	53625	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:47.737200022 CET	53	53625	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:47.738086939 CET	55384	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:48.053153038 CET	53	55384	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:48.054260015 CET	53200	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:48.290024042 CET	53	53200	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:48.290868998 CET	63641	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:48.601294041 CET	53	63641	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:48.602947950 CET	63305	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:48.839884996 CET	53	63305	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:48.852830887 CET	49167	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:49.162575960 CET	53	49167	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:49.195569992 CET	50915	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:49.439954042 CET	53	50915	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:49.498979092 CET	52856	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:49.749134064 CET	53	52856	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:49.750076056 CET	61099	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:49.990164042 CET	53	61099	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:49.991121054 CET	52834	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:50.219743967 CET	53	52834	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:50.220936060 CET	49300	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:50.530962944 CET	53	49300	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:50.532038927 CET	52857	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:50.770358086 CET	53	52857	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:50.771375895 CET	57370	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:51.014132977 CET	53	57370	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:51.015032053 CET	53536	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:51.243972063 CET	53	53536	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:51.244959116 CET	59465	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:51.488219023 CET	53	59465	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:51.489162922 CET	52244	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:51.733827114 CET	53	52244	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:51.735234022 CET	53827	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:52.052083969 CET	53	53827	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:52.116364002 CET	53827	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:52.126744032 CET	65113	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:52.254209995 CET	53	53827	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:52.390455008 CET	53	65113	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:52.458657980 CET	49934	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:52.677431107 CET	53	49934	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:52.678318024 CET	62264	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:52.929383039 CET	53	62264	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:52.930201054 CET	64020	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:53.238243103 CET	53	64020	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:53.239197969 CET	62571	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:53.465738058 CET	53	62571	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:53.466754913 CET	50439	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:53.695130110 CET	53	50439	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:53.696007967 CET	55664	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:53.937638998 CET	53	55664	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:53.938606024 CET	63152	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:54.187500000 CET	53	63152	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:54.188436985 CET	49939	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:54.436925888 CET	53	49939	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:54.437866926 CET	64933	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:54.667213917 CET	53	64933	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:54.668432951 CET	50188	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:54.909279108 CET	53	50188	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:54.910494089 CET	62476	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:55.159779072 CET	53	62476	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:55.225720882 CET	65343	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:55.551537037 CET	53	65343	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:55.600123882 CET	56630	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:55.909738064 CET	53	56630	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:55.910928965 CET	52641	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:56.146229982 CET	53	52641	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:56.147093058 CET	56833	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:56.457927942 CET	53	56833	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:56.458784103 CET	63054	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:56.698515892 CET	53	63054	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:56.699390888 CET	53444	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:57.007752895 CET	53	53444	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:57.008605003 CET	58532	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:57.241225958 CET	53	58532	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:57.245102882 CET	60953	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:57.470284939 CET	53	60953	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:57.471926928 CET	50218	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:57.714262962 CET	53	50218	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:57.715126038 CET	56421	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:58.027463913 CET	53	56421	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:58.028471947 CET	53412	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:58.269046068 CET	53	53412	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:58.340850115 CET	59831	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:58.586529016 CET	53	59831	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:58.671828032 CET	61329	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:58.980000019 CET	53	61329	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:58.981062889 CET	57979	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:59.203002930 CET	53	57979	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:59.203973055 CET	58033	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:59.438256025 CET	53	58033	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:59.439290047 CET	60172	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:59.670105934 CET	53	60172	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:59.671089888 CET	51070	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:43:59.903414965 CET	53	51070	1.1.1.1	192.168.2.6
Nov 25, 2024 07:43:59.904417038 CET	64869	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:00.216659069 CET	53	64869	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:00.217678070 CET	57541	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:00.470738888 CET	53	57541	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:00.471667051 CET	53717	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:00.781317949 CET	53	53717	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:00.782411098 CET	58877	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:01.026487112 CET	53	58877	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:01.028171062 CET	55606	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:01.269742966 CET	53	55606	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:01.296113014 CET	55346	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:01.541486979 CET	53	55346	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:01.547884941 CET	61573	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:01.786108017 CET	53	61573	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:01.908490896 CET	61573	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:01.985766888 CET	56995	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:02.048063993 CET	53	61573	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:02.249149084 CET	53	56995	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:02.250134945 CET	51004	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:02.480557919 CET	53	51004	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:02.481414080 CET	58855	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:02.733845949 CET	53	58855	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:02.734766006 CET	51474	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:02.974003077 CET	53	51474	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:02.974865913 CET	58895	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:03.211910009 CET	53	58895	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:03.213344097 CET	64740	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:03.455249071 CET	53	64740	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:03.456264973 CET	63241	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:03.698102951 CET	53	63241	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:03.699150085 CET	62747	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:03.946463108 CET	53	62747	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:03.947475910 CET	61674	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:04.188389063 CET	53	61674	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:04.189583063 CET	50484	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:04.435045958 CET	53	50484	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:04.447952032 CET	65223	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:04.675648928 CET	53	65223	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:04.677423954 CET	56502	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:04.899713039 CET	53	56502	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:05.010627031 CET	53916	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:05.246804953 CET	53	53916	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:05.247859001 CET	56848	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:05.555862904 CET	53	56848	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:05.556890965 CET	64188	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:05.790980101 CET	53	64188	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:05.792088032 CET	65376	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:06.016784906 CET	53	65376	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:06.018018007 CET	57620	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:06.333933115 CET	53	57620	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:06.340368032 CET	49787	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:06.654351950 CET	53	49787	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:06.655307055 CET	65072	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:06.874938965 CET	53	65072	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:06.875865936 CET	49202	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:07.197145939 CET	53	49202	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:07.198827028 CET	59655	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:07.433290958 CET	53	59655	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:07.459960938 CET	60076	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:07.705730915 CET	53	60076	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:07.715811014 CET	59196	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:07.956087112 CET	53	59196	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:07.964306116 CET	65351	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:08.196630955 CET	53	65351	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:08.335654974 CET	65351	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:08.351620913 CET	65322	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:08.476399899 CET	53	65351	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:08.590045929 CET	53	65322	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:08.591502905 CET	65410	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:08.838795900 CET	53	65410	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:08.842700958 CET	56339	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:09.089219093 CET	53	56339	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:09.090524912 CET	61811	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:09.340167046 CET	53	61811	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:09.341471910 CET	53494	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:09.583197117 CET	53	53494	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:09.584546089 CET	49813	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:09.822994947 CET	53	49813	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:09.825234890 CET	61507	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:10.056111097 CET	53	61507	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:10.063687086 CET	58291	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:10.374075890 CET	53	58291	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:10.381644011 CET	63082	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:10.625415087 CET	53	63082	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:10.633656025 CET	58006	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:10.865286112 CET	53	58006	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:11.881622076 CET	58006	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:11.909925938 CET	58189	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:12.018609047 CET	53	58006	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:12.145020008 CET	53	58189	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:12.146327019 CET	63767	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:12.401329041 CET	53	63767	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:12.402265072 CET	54506	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:12.632859945 CET	53	54506	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:12.634340048 CET	63741	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:12.876761913 CET	53	63741	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:12.877840042 CET	61130	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:13.104465008 CET	53	61130	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:13.105410099 CET	55549	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:13.419819117 CET	53	55549	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:13.424015999 CET	55775	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:13.733840942 CET	53	55775	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:13.735666037 CET	53749	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:13.972490072 CET	53	53749	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:13.976507902 CET	58178	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:14.212250948 CET	53	58178	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:14.214147091 CET	59593	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:14.447740078 CET	53	59593	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:14.448784113 CET	58510	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:14.680013895 CET	53	58510	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:14.680834055 CET	52768	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:14.924366951 CET	53	52768	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:14.925415993 CET	57731	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:15.158324003 CET	53	57731	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:15.159195900 CET	59344	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:15.472670078 CET	53	59344	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:15.473614931 CET	62564	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:15.701895952 CET	53	62564	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:15.707961082 CET	55617	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:15.964088917 CET	53	55617	1.1.1.1	192.168.2.6
Nov 25, 2024 07:44:15.967694998 CET	53068	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:44:16.276987076 CET	53	53068	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 25, 2024 07:42:43.464306116 CET	192.168.2.6	1.1.1.1	0xd229	Standard query (0)	qckwwsmukogkeuge.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:43.880501032 CET	192.168.2.6	1.1.1.1	0x3aa2	Standard query (0)	keoqiqigggqkcykq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:44.413459063 CET	192.168.2.6	1.1.1.1	0x2f7f	Standard query (0)	kqsamcsauqiagmma.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:44.664470911 CET	192.168.2.6	1.1.1.1	0x1b53	Standard query (0)	mocikyoeikocwkuc.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:44.909230947 CET	192.168.2.6	1.1.1.1	0x8e75	Standard query (0)	uymiagmwmqmimewm.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:45.155025959 CET	192.168.2.6	1.1.1.1	0x8dfd	Standard query (0)	gcikuiqswcgsscog.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:45.823261023 CET	192.168.2.6	1.1.1.1	0xd346	Standard query (0)	qwmaokcmiwuqqyes.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:46.182852030 CET	192.168.2.6	1.1.1.1	0x4c77	Standard query (0)	igaiseoqksuoukqg.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:46.417956114 CET	192.168.2.6	1.1.1.1	0xd216	Standard query (0)	kqukwaogqoucsaas.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:46.653711081 CET	192.168.2.6	1.1.1.1	0x1306	Standard query (0)	miacggmycyqikoyq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:46.881192923 CET	192.168.2.6	1.1.1.1	0x9b49	Standard query (0)	woceumwmwioocusa.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:47.108850956 CET	192.168.2.6	1.1.1.1	0x9dc4	Standard query (0)	acgcaiyykiigugms.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:47.420420885 CET	192.168.2.6	1.1.1.1	0xdd7e	Standard query (0)	cogsyycsuwoysugi.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:47.736210108 CET	192.168.2.6	1.1.1.1	0x5267	Standard query (0)	oekyamueeiiousia.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:47.976500988 CET	192.168.2.6	1.1.1.1	0xc806	Standard query (0)	wukaqiusicksuguo.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:48.210808039 CET	192.168.2.6	1.1.1.1	0x1b9d	Standard query (0)	yyusosuyycoeikgo.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:48.463329077 CET	192.168.2.6	1.1.1.1	0x8895	Standard query (0)	kqoceoymymoicqky.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:48.791054010 CET	192.168.2.6	1.1.1.1	0x323f	Standard query (0)	uykkwkqqemamguwa.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:49.310750008 CET	192.168.2.6	1.1.1.1	0xbb0c	Standard query (0)	oyekqyccewougasu.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:49.623070955 CET	192.168.2.6	1.1.1.1	0xdd53	Standard query (0)	ymsaymyugccysmow.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:49.862099886 CET	192.168.2.6	1.1.1.1	0xba84	Standard query (0)	omuquowgiusiesgk.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:50.176597118 CET	192.168.2.6	1.1.1.1	0x6936	Standard query (0)	wiywykakusaygisc.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:50.487739086 CET	192.168.2.6	1.1.1.1	0x38a6	Standard query (0)	aqmqywkwsmmayyoi.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:50.806289911 CET	192.168.2.6	1.1.1.1	0x2558	Standard query (0)	cuccygameukkeumw.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:51.119014025 CET	192.168.2.6	1.1.1.1	0xae3e	Standard query (0)	ukekykoqskumoikg.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:51.358179092 CET	192.168.2.6	1.1.1.1	0x358f	Standard query (0)	uyqcacmsiquuwggq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:51.594341993 CET	192.168.2.6	1.1.1.1	0xf99a	Standard query (0)	ysoqqwckkqssyigm.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:51.824454069 CET	192.168.2.6	1.1.1.1	0x3f6d	Standard query (0)	yyemsyoimicqmais.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:52.076585054 CET	192.168.2.6	1.1.1.1	0xcd23	Standard query (0)	miigookwguakmkeu.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:52.315563917 CET	192.168.2.6	1.1.1.1	0x3707	Standard query (0)	qiuswcgwaqgemwcg.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:52.629292965 CET	192.168.2.6	1.1.1.1	0xc2b7	Standard query (0)	wuusiiukmwcmimyk.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:52.861469030 CET	192.168.2.6	1.1.1.1	0x7b7e	Standard query (0)	uqyukkamycuaimsu.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:53.102334976 CET	192.168.2.6	1.1.1.1	0x15d5	Standard query (0)	woeamasicuiqyckq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:53.329421997 CET	192.168.2.6	1.1.1.1	0x3556	Standard query (0)	akaueuwoocwkkoya.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:53.638227940 CET	192.168.2.6	1.1.1.1	0xe51f	Standard query (0)	qciqgoeogwwmwkcw.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:53.893789053 CET	192.168.2.6	1.1.1.1	0xed96	Standard query (0)	ucwesqiquqggymqe.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:54.214035034 CET	192.168.2.6	1.1.1.1	0x82da	Standard query (0)	mgseamqmgkqcuewy.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:54.834059000 CET	192.168.2.6	1.1.1.1	0x51d1	Standard query (0)	gaoweoyqcuuykwgu.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:55.153644085 CET	192.168.2.6	1.1.1.1	0x8441	Standard query (0)	oqegmuqkgyaywwmc.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:55.403769016 CET	192.168.2.6	1.1.1.1	0x9388	Standard query (0)	qusmiuqmmgqsgeci.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:55.641443014 CET	192.168.2.6	1.1.1.1	0x767d	Standard query (0)	yqcakkmwigkaumii.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:55.880984068 CET	192.168.2.6	1.1.1.1	0x42d5	Standard query (0)	qokykyyigsyqggqe.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:56.131288052 CET	192.168.2.6	1.1.1.1	0x6124	Standard query (0)	cyyyokugycioysok.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:56.360151052 CET	192.168.2.6	1.1.1.1	0x8f21	Standard query (0)	iqcaysimoeeqamky.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:56.583225012 CET	192.168.2.6	1.1.1.1	0x62e1	Standard query (0)	yekiwquqaacesqqq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:56.813731909 CET	192.168.2.6	1.1.1.1	0x99d8	Standard query (0)	gmooqswyuuqaiomi.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:57.049815893 CET	192.168.2.6	1.1.1.1	0xe9de	Standard query (0)	kuiomoiwauwckqeq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:57.369887114 CET	192.168.2.6	1.1.1.1	0x9712	Standard query (0)	ceucuuwiwwuiweaq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:57.683021069 CET	192.168.2.6	1.1.1.1	0x894e	Standard query (0)	cycscsqyqkeaykgc.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:57.924798012 CET	192.168.2.6	1.1.1.1	0xfc58	Standard query (0)	ssagiiaauyewiswa.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:58.161421061 CET	192.168.2.6	1.1.1.1	0x11d8	Standard query (0)	ggwsuoyyioagegkw.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:58.388288021 CET	192.168.2.6	1.1.1.1	0xdd12	Standard query (0)	ieikmuieoqqmugwu.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:58.701956987 CET	192.168.2.6	1.1.1.1	0xf999	Standard query (0)	kcqkucqkogqiuukw.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:58.939502954 CET	192.168.2.6	1.1.1.1	0xbe41	Standard query (0)	oqouwceoowyiwgag.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:59.177403927 CET	192.168.2.6	1.1.1.1	0x5aa2	Standard query (0)	gakowseyscmeqkya.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:59.403347015 CET	192.168.2.6	1.1.1.1	0xb66c	Standard query (0)	quisoakcuqsygyyc.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:59.639667988 CET	192.168.2.6	1.1.1.1	0x7718	Standard query (0)	auuisqaykqgeesae.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:00.028580904 CET	192.168.2.6	1.1.1.1	0x8dfb	Standard query (0)	iyawyckqggkwsyoq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:00.294835091 CET	192.168.2.6	1.1.1.1	0x8099	Standard query (0)	ecmyomcaicqysoqw.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:00.549355030 CET	192.168.2.6	1.1.1.1	0x61b0	Standard query (0)	iqcqqquiwomgsmma.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:00.808516979 CET	192.168.2.6	1.1.1.1	0x522e	Standard query (0)	ssegwgieumyoasym.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:01.050117016 CET	192.168.2.6	1.1.1.1	0x7786	Standard query (0)	ceeomiecgymecgau.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:01.295974970 CET	192.168.2.6	1.1.1.1	0xa807	Standard query (0)	myisokqwsmqeusuy.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:01.538409948 CET	192.168.2.6	1.1.1.1	0xb2c0	Standard query (0)	ywkamsiogkycyosy.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:01.860862017 CET	192.168.2.6	1.1.1.1	0xb985	Standard query (0)	ggkyecqguqkkuoso.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:02.177170038 CET	192.168.2.6	1.1.1.1	0xd9a4	Standard query (0)	kcyoeiykekuqkkmg.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:02.415323019 CET	192.168.2.6	1.1.1.1	0x3deb	Standard query (0)	ikwyuqgsegcgcccg.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:02.652218103 CET	192.168.2.6	1.1.1.1	0xd6b4	Standard query (0)	wgswkwaesqqwkoaa.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:02.902115107 CET	192.168.2.6	1.1.1.1	0xae12	Standard query (0)	eqkkkcuwkiqiecac.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:03.219548941 CET	192.168.2.6	1.1.1.1	0xf36b	Standard query (0)	kigcewceemkckeow.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:03.507993937 CET	192.168.2.6	1.1.1.1	0x54bc	Standard query (0)	ykaimcgigakggwec.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:03.800121069 CET	192.168.2.6	1.1.1.1	0x13a8	Standard query (0)	uceaygkekiassamu.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:04.116976023 CET	192.168.2.6	1.1.1.1	0xdc61	Standard query (0)	seioywksogeseqig.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:04.346290112 CET	192.168.2.6	1.1.1.1	0x2252	Standard query (0)	ssoqscyewimqiqme.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:04.571490049 CET	192.168.2.6	1.1.1.1	0x8bf5	Standard query (0)	kocgeaeoakgqewog.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:04.816287041 CET	192.168.2.6	1.1.1.1	0x15fa	Standard query (0)	kuiqsugkqeoscguo.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:05.064374924 CET	192.168.2.6	1.1.1.1	0xe3ae	Standard query (0)	kcsqwmkusesaccwa.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:05.374727011 CET	192.168.2.6	1.1.1.1	0xd791	Standard query (0)	ywyawywiuyecuiuu.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:05.621646881 CET	192.168.2.6	1.1.1.1	0xf5b5	Standard query (0)	uowowiqiyeiuwmcc.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:05.846971989 CET	192.168.2.6	1.1.1.1	0x3f27	Standard query (0)	uokqeaieowiogsgc.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:06.073775053 CET	192.168.2.6	1.1.1.1	0xbf61	Standard query (0)	ikoqkscwsowwukmi.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:06.329042912 CET	192.168.2.6	1.1.1.1	0x5712	Standard query (0)	iymukyseoieqccac.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:06.572308064 CET	192.168.2.6	1.1.1.1	0x5b28	Standard query (0)	qascmswkaisogoaq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:06.882637024 CET	192.168.2.6	1.1.1.1	0x5710	Standard query (0)	gacgceaygaecuguy.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:07.123203039 CET	192.168.2.6	1.1.1.1	0xfa8b	Standard query (0)	eqyyguuwsyqaqgsq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:07.360481977 CET	192.168.2.6	1.1.1.1	0x1600	Standard query (0)	ewywcoeukaoaegci.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:07.598690033 CET	192.168.2.6	1.1.1.1	0x3cbd	Standard query (0)	mmygsewuukqkiiok.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:07.839215994 CET	192.168.2.6	1.1.1.1	0xa25f	Standard query (0)	wgyimykogekgewoa.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:08.082452059 CET	192.168.2.6	1.1.1.1	0xeb69	Standard query (0)	uiguoqqagkiuagyc.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:08.330746889 CET	192.168.2.6	1.1.1.1	0xe12f	Standard query (0)	kcesagqugouwkqyg.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:08.580909014 CET	192.168.2.6	1.1.1.1	0x94c9	Standard query (0)	yqeugeoquqsokgqk.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:08.810751915 CET	192.168.2.6	1.1.1.1	0xce73	Standard query (0)	eigkgwkyuqssgamw.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:09.036112070 CET	192.168.2.6	1.1.1.1	0xd9e1	Standard query (0)	waqmyueimmyiuawq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:09.348423958 CET	192.168.2.6	1.1.1.1	0x985a	Standard query (0)	qgukewuuykmmkgeq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:09.597450018 CET	192.168.2.6	1.1.1.1	0x9757	Standard query (0)	gmwcscokucowyogs.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:09.828943968 CET	192.168.2.6	1.1.1.1	0xfe28	Standard query (0)	ywegqamoegumacgi.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:10.083009958 CET	192.168.2.6	1.1.1.1	0x3a9c	Standard query (0)	yquocucuqoywwcsu.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:10.394516945 CET	192.168.2.6	1.1.1.1	0xc079	Standard query (0)	eqmeimmouegoasay.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:10.706979990 CET	192.168.2.6	1.1.1.1	0x10a	Standard query (0)	cykgmsqcgysgaioo.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:10.948496103 CET	192.168.2.6	1.1.1.1	0xf254	Standard query (0)	oqoemaogyoikomiy.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:11.188294888 CET	192.168.2.6	1.1.1.1	0x22e9	Standard query (0)	qoiiomimuoaqgeku.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:11.426316977 CET	192.168.2.6	1.1.1.1	0x3abb	Standard query (0)	wgymkeismmiemsqq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:11.674643040 CET	192.168.2.6	1.1.1.1	0x8669	Standard query (0)	ykocagogmeiwmymy.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:11.918459892 CET	192.168.2.6	1.1.1.1	0xb0de	Standard query (0)	csoqiicgaaiyyoom.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:12.151550055 CET	192.168.2.6	1.1.1.1	0x6438	Standard query (0)	koioiiwouukqousy.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:12.441626072 CET	192.168.2.6	1.1.1.1	0x3e18	Standard query (0)	okkyekwuommcicqi.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:12.947151899 CET	192.168.2.6	1.1.1.1	0x229b	Standard query (0)	ecacmycegqoaquio.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:13.182254076 CET	192.168.2.6	1.1.1.1	0xd5a8	Standard query (0)	skgcsksqyekiymii.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:13.419017076 CET	192.168.2.6	1.1.1.1	0xb3bc	Standard query (0)	kckcekceqgcyqcsa.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:13.648360968 CET	192.168.2.6	1.1.1.1	0xe054	Standard query (0)	uoaeyoycyycqkoci.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:13.875338078 CET	192.168.2.6	1.1.1.1	0x4213	Standard query (0)	wsaekoiomeagsaes.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:14.117770910 CET	192.168.2.6	1.1.1.1	0x6a53	Standard query (0)	iqmeccigieosgmwq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:14.433605909 CET	192.168.2.6	1.1.1.1	0x4bcb	Standard query (0)	ggeqowwmmmeekigg.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:14.674534082 CET	192.168.2.6	1.1.1.1	0xbd89	Standard query (0)	sssawsmmkmuyqsaq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:14.925183058 CET	192.168.2.6	1.1.1.1	0x997b	Standard query (0)	ecmckkeyoskcigeu.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:15.235819101 CET	192.168.2.6	1.1.1.1	0xe747	Standard query (0)	quoqoooiamqkkosc.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:15.461658001 CET	192.168.2.6	1.1.1.1	0xd5	Standard query (0)	waokmuyyeooamowm.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:15.771589041 CET	192.168.2.6	1.1.1.1	0x2809	Standard query (0)	ykomskascimimomo.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:16.138097048 CET	192.168.2.6	1.1.1.1	0x4dba	Standard query (0)	mmisquwegymayaee.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:16.454595089 CET	192.168.2.6	1.1.1.1	0xe18b	Standard query (0)	mmyukmsqamgicqai.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:16.694472075 CET	192.168.2.6	1.1.1.1	0x5f90	Standard query (0)	ikwyooieywakeqog.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:17.007237911 CET	192.168.2.6	1.1.1.1	0xdcbc	Standard query (0)	mgwmkyyqckeewgce.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:17.240540028 CET	192.168.2.6	1.1.1.1	0x2e8f	Standard query (0)	owoksuegymmgesys.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:17.552164078 CET	192.168.2.6	1.1.1.1	0xdd03	Standard query (0)	aamuskacaaiycguu.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:17.865415096 CET	192.168.2.6	1.1.1.1	0x601b	Standard query (0)	yegskieoocgoamyi.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:18.099334002 CET	192.168.2.6	1.1.1.1	0xebe	Standard query (0)	aaiouwywwcwuuasm.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:18.336313009 CET	192.168.2.6	1.1.1.1	0x2d37	Standard query (0)	kuoqgwooymgsqaum.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:19.124227047 CET	192.168.2.6	1.1.1.1	0x95af	Standard query (0)	myoyccuwcyaygceg.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:19.353621960 CET	192.168.2.6	1.1.1.1	0x87cb	Standard query (0)	ggqgwuaseamkyywa.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:19.664093971 CET	192.168.2.6	1.1.1.1	0xb176	Standard query (0)	uwimwwicgcscuoku.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:19.910269976 CET	192.168.2.6	1.1.1.1	0x44af	Standard query (0)	cyyukyomsoiqyyqa.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:20.225688934 CET	192.168.2.6	1.1.1.1	0x8769	Standard query (0)	gaisoawuoicqsumy.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:20.463166952 CET	192.168.2.6	1.1.1.1	0x5603	Standard query (0)	qogsmcecyusiyaim.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:20.691302061 CET	192.168.2.6	1.1.1.1	0xeec2	Standard query (0)	ykqocceawkwoagmc.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:20.923909903 CET	192.168.2.6	1.1.1.1	0xe2f5	Standard query (0)	aosywgkogcissggi.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:21.240528107 CET	192.168.2.6	1.1.1.1	0x638f	Standard query (0)	ieywwkeuouoqgqms.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:21.485487938 CET	192.168.2.6	1.1.1.1	0x5cf8	Standard query (0)	ecgkeyeueawgcuqo.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:21.776146889 CET	192.168.2.6	1.1.1.1	0xc8ec	Standard query (0)	guimuaoiecmouigq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:22.162096024 CET	192.168.2.6	1.1.1.1	0x5e64	Standard query (0)	ggkyuooyikmqoscw.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:22.504165888 CET	192.168.2.6	1.1.1.1	0x8030	Standard query (0)	uoeeuiaewmogugeo.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:22.753050089 CET	192.168.2.6	1.1.1.1	0x4781	Standard query (0)	okgeqaswygsgykme.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:22.989537954 CET	192.168.2.6	1.1.1.1	0x6f74	Standard query (0)	ywqiciegywcouoiy.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:23.232347012 CET	192.168.2.6	1.1.1.1	0x82f0	Standard query (0)	qgkgogieieoomkqq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:23.547350883 CET	192.168.2.6	1.1.1.1	0xd3a1	Standard query (0)	qgkmsekougssaawq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:23.857249975 CET	192.168.2.6	1.1.1.1	0x227	Standard query (0)	ggmwwewskeiggosq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:24.168231964 CET	192.168.2.6	1.1.1.1	0x2aab	Standard query (0)	eqgwaamacqweiwie.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:24.415196896 CET	192.168.2.6	1.1.1.1	0xde5a	Standard query (0)	wmqcgwcegsomeqas.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:24.663361073 CET	192.168.2.6	1.1.1.1	0xbd75	Standard query (0)	oqummowmqwcgsegm.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:24.915460110 CET	192.168.2.6	1.1.1.1	0x78ad	Standard query (0)	qoowyoueaaaccgqs.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:25.246970892 CET	192.168.2.6	1.1.1.1	0xa43	Standard query (0)	csiykwakekqoqaym.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:25.568589926 CET	192.168.2.6	1.1.1.1	0xc67e	Standard query (0)	mmymmauyiiksiugu.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:25.814660072 CET	192.168.2.6	1.1.1.1	0xb983	Standard query (0)	cseksqccmgaieyic.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:26.044840097 CET	192.168.2.6	1.1.1.1	0xbc8	Standard query (0)	cykgucwkesokooyw.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:26.360003948 CET	192.168.2.6	1.1.1.1	0x807a	Standard query (0)	okoguckagygoqqgk.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:26.598427057 CET	192.168.2.6	1.1.1.1	0x74a8	Standard query (0)	cyswykkcmggyiqwo.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:26.825088024 CET	192.168.2.6	1.1.1.1	0xfff7	Standard query (0)	gmmacaiigwcscggs.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:27.058423042 CET	192.168.2.6	1.1.1.1	0x304	Standard query (0)	yequgaccqouegcmw.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:27.302445889 CET	192.168.2.6	1.1.1.1	0x6cbc	Standard query (0)	sksiyqgummyycgmi.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:27.536880016 CET	192.168.2.6	1.1.1.1	0xb78d	Standard query (0)	skekiggeimmceqcg.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:27.851097107 CET	192.168.2.6	1.1.1.1	0x69a1	Standard query (0)	eiqqequeskcqiqmw.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:28.130888939 CET	192.168.2.6	1.1.1.1	0xf1d4	Standard query (0)	ecsamoyaimquqwow.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:28.417211056 CET	192.168.2.6	1.1.1.1	0x5765	Standard query (0)	aiyksmkyqgyaemiw.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:28.768594980 CET	192.168.2.6	1.1.1.1	0xc10e	Standard query (0)	owewoieiwasaueco.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:29.009864092 CET	192.168.2.6	1.1.1.1	0x141b	Standard query (0)	aoymcmmeqqqgwwca.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:29.320116043 CET	192.168.2.6	1.1.1.1	0xd61d	Standard query (0)	iygsiugeeogoeiyi.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:29.631831884 CET	192.168.2.6	1.1.1.1	0x9299	Standard query (0)	quuemeewaqaiiyqc.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:29.949266911 CET	192.168.2.6	1.1.1.1	0x95a9	Standard query (0)	wggikwiqowiwqcqg.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:30.201216936 CET	192.168.2.6	1.1.1.1	0x68e0	Standard query (0)	ucuiiwcwwgimkyyi.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:30.437370062 CET	192.168.2.6	1.1.1.1	0xc093	Standard query (0)	koiugmaqgkawaiyw.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:30.661936998 CET	192.168.2.6	1.1.1.1	0x501	Standard query (0)	waeqkmeeasauygum.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:30.907953024 CET	192.168.2.6	1.1.1.1	0xbe20	Standard query (0)	ecimsaauyieykegi.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:31.158586025 CET	192.168.2.6	1.1.1.1	0x7837	Standard query (0)	ocsqocikkcggeaaw.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:31.399908066 CET	192.168.2.6	1.1.1.1	0xc4	Standard query (0)	iyaqqeamygmakcgo.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:31.645375967 CET	192.168.2.6	1.1.1.1	0x951f	Standard query (0)	uowgcyqcgaqiumoi.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:31.905848026 CET	192.168.2.6	1.1.1.1	0x8272	Standard query (0)	myymasomksgeawqw.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:32.145226955 CET	192.168.2.6	1.1.1.1	0xe508	Standard query (0)	myaueqycgeikwagc.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:32.378634930 CET	192.168.2.6	1.1.1.1	0xbe47	Standard query (0)	seoomaqwwimwueiw.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:32.691608906 CET	192.168.2.6	1.1.1.1	0xa3c8	Standard query (0)	mgeycqkiwggsymyc.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:32.926363945 CET	192.168.2.6	1.1.1.1	0xccab	Standard query (0)	ikgkgaaqqsmomuim.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:33.164741993 CET	192.168.2.6	1.1.1.1	0xe4d3	Standard query (0)	ieuaeqceycqyqygk.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:33.396120071 CET	192.168.2.6	1.1.1.1	0x40cb	Standard query (0)	waeqwwagawqkksya.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:33.710397005 CET	192.168.2.6	1.1.1.1	0xa22b	Standard query (0)	mmeuqmoaekswggoe.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:33.950059891 CET	192.168.2.6	1.1.1.1	0x13ba	Standard query (0)	ucyoqcksaiiwgqae.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:34.318192005 CET	192.168.2.6	1.1.1.1	0x1da3	Standard query (0)	aoosomigeaiewqom.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:34.558356047 CET	192.168.2.6	1.1.1.1	0xd1ad	Standard query (0)	cyqaqqcqamemsiog.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:34.965249062 CET	192.168.2.6	1.1.1.1	0xd1ad	Standard query (0)	cyqaqqcqamemsiog.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:35.063849926 CET	192.168.2.6	1.1.1.1	0x61fe	Standard query (0)	wacqigcacsemkyos.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:35.302622080 CET	192.168.2.6	1.1.1.1	0x312e	Standard query (0)	yqocoeikiyacyuck.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:35.528698921 CET	192.168.2.6	1.1.1.1	0xcc03	Standard query (0)	ywcuqkkmmqioiwqk.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:35.838460922 CET	192.168.2.6	1.1.1.1	0xada7	Standard query (0)	waqcciyigkuoygqy.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:36.086256027 CET	192.168.2.6	1.1.1.1	0x882	Standard query (0)	ceoqyeiycqkumwao.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:36.319363117 CET	192.168.2.6	1.1.1.1	0xd088	Standard query (0)	aauquiiqeugcwswc.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:36.553515911 CET	192.168.2.6	1.1.1.1	0xf9e8	Standard query (0)	uoeiymqawsqiyuck.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:36.923939943 CET	192.168.2.6	1.1.1.1	0xf9e8	Standard query (0)	uoeiymqawsqiyuck.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:37.046767950 CET	192.168.2.6	1.1.1.1	0x4996	Standard query (0)	yqceweqmaumwwywy.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:37.274560928 CET	192.168.2.6	1.1.1.1	0x6503	Standard query (0)	eqmycgagykgkqwsu.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:37.510082960 CET	192.168.2.6	1.1.1.1	0xebe9	Standard query (0)	seuuicaewuoaumes.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:37.785758018 CET	192.168.2.6	1.1.1.1	0xaee2	Standard query (0)	aomaeyokqgsuomii.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:38.043611050 CET	192.168.2.6	1.1.1.1	0xadf7	Standard query (0)	waqucgoeeeeymeii.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:38.275501013 CET	192.168.2.6	1.1.1.1	0x3e15	Standard query (0)	oqacqgmiaaewmmey.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:38.500360966 CET	192.168.2.6	1.1.1.1	0x6351	Standard query (0)	ykeaoyaycoiamqey.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:38.751029015 CET	192.168.2.6	1.1.1.1	0x7807	Standard query (0)	csmgwcogqqcwseka.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:38.994399071 CET	192.168.2.6	1.1.1.1	0xa638	Standard query (0)	auowmussgaesgwas.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:39.244103909 CET	192.168.2.6	1.1.1.1	0x670f	Standard query (0)	aikmouciiqgecoqi.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:39.483690977 CET	192.168.2.6	1.1.1.1	0x7a96	Standard query (0)	koecgqggegimaeya.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:39.792783976 CET	192.168.2.6	1.1.1.1	0xec83	Standard query (0)	aawqwccomcemcysm.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:40.017148018 CET	192.168.2.6	1.1.1.1	0x48fe	Standard query (0)	kcyakwisycecaqgw.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:40.266743898 CET	192.168.2.6	1.1.1.1	0x9eb7	Standard query (0)	uogksceymossmmqc.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:40.506114006 CET	192.168.2.6	1.1.1.1	0xbb94	Standard query (0)	qgmyeeguweaukuke.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:40.757960081 CET	192.168.2.6	1.1.1.1	0x6f1d	Standard query (0)	mywaqkeaawisisky.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:41.013824940 CET	192.168.2.6	1.1.1.1	0x7819	Standard query (0)	yqqsggacauiiugka.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:41.329997063 CET	192.168.2.6	1.1.1.1	0x37d9	Standard query (0)	equmqmqwuuuioawa.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:41.562891006 CET	192.168.2.6	1.1.1.1	0xf8c0	Standard query (0)	wmoamsauiwauoosg.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:41.887166977 CET	192.168.2.6	1.1.1.1	0x626c	Standard query (0)	oqsakkimkesccikc.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:42.128591061 CET	192.168.2.6	1.1.1.1	0x4de	Standard query (0)	mgiwaegaqyyaakwy.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:42.370120049 CET	192.168.2.6	1.1.1.1	0x1bba	Standard query (0)	ucmioacycscyeouk.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:42.617572069 CET	192.168.2.6	1.1.1.1	0x64e	Standard query (0)	qumaseqmggyaiauq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:42.906753063 CET	192.168.2.6	1.1.1.1	0xbe38	Standard query (0)	uccyyemqaiiksuwm.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:43.169754982 CET	192.168.2.6	1.1.1.1	0x9b2a	Standard query (0)	sesyieaiesegeaow.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:43.388984919 CET	192.168.2.6	1.1.1.1	0xb3da	Standard query (0)	kccmicaswqmswwak.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:43.628256083 CET	192.168.2.6	1.1.1.1	0xbcff	Standard query (0)	mssaogwocegysoow.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:43.849431992 CET	192.168.2.6	1.1.1.1	0x902a	Standard query (0)	wssaqmakumewmaes.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:44.102257967 CET	192.168.2.6	1.1.1.1	0x6b65	Standard query (0)	cmukociggiqcouio.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:44.344846964 CET	192.168.2.6	1.1.1.1	0xd48	Standard query (0)	skyqsyyymyacyayc.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:44.655431986 CET	192.168.2.6	1.1.1.1	0x751b	Standard query (0)	uoigsiqmemcscosu.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:44.970592022 CET	192.168.2.6	1.1.1.1	0xaad7	Standard query (0)	kuywuskkgqsigqqs.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:45.281968117 CET	192.168.2.6	1.1.1.1	0x552b	Standard query (0)	auayomwkewcomwas.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:45.516151905 CET	192.168.2.6	1.1.1.1	0x4777	Standard query (0)	iyaikmkkowcqemsi.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:45.841872931 CET	192.168.2.6	1.1.1.1	0x120d	Standard query (0)	ggicikyqcaiyguee.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:46.084501028 CET	192.168.2.6	1.1.1.1	0x1d1c	Standard query (0)	oqyaoykomyoygics.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:46.397847891 CET	192.168.2.6	1.1.1.1	0xd86f	Standard query (0)	eqakguiwiqacqiwg.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:46.633690119 CET	192.168.2.6	1.1.1.1	0x34e7	Standard query (0)	wgcaouuqqqwucogy.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:46.887439966 CET	192.168.2.6	1.1.1.1	0xfe01	Standard query (0)	ewacuagosgqmuocm.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:47.198232889 CET	192.168.2.6	1.1.1.1	0x19b5	Standard query (0)	wgqyouayikuyuqmk.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:47.510571957 CET	192.168.2.6	1.1.1.1	0xff7e	Standard query (0)	owaaygsacguucaye.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:47.738086939 CET	192.168.2.6	1.1.1.1	0x44b6	Standard query (0)	uwgicagyykoommga.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:48.054260015 CET	192.168.2.6	1.1.1.1	0xd554	Standard query (0)	uiggameqqycugsqw.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:48.290868998 CET	192.168.2.6	1.1.1.1	0x5430	Standard query (0)	goguooqkgysueime.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:48.602947950 CET	192.168.2.6	1.1.1.1	0x9c90	Standard query (0)	keosqeosukqcooco.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:48.852830887 CET	192.168.2.6	1.1.1.1	0x1991	Standard query (0)	maoeeogmuauywsyu.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:49.195569992 CET	192.168.2.6	1.1.1.1	0xd5c4	Standard query (0)	ismqaewykmoiguki.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:49.498979092 CET	192.168.2.6	1.1.1.1	0xd5cc	Standard query (0)	wucwykasawokemaw.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:49.750076056 CET	192.168.2.6	1.1.1.1	0x8cf3	Standard query (0)	ukmcqucewskcqygg.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:49.991121054 CET	192.168.2.6	1.1.1.1	0xb26a	Standard query (0)	qqqmeagkkosgcayo.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:50.220936060 CET	192.168.2.6	1.1.1.1	0x3c63	Standard query (0)	ysawassgkwqygmmq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:50.532038927 CET	192.168.2.6	1.1.1.1	0xc208	Standard query (0)	osaeyoiqoqawauga.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:50.771375895 CET	192.168.2.6	1.1.1.1	0xb326	Standard query (0)	iagisciiyoemgwaa.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:51.015032053 CET	192.168.2.6	1.1.1.1	0xa53d	Standard query (0)	ymysimqoykwqeqiq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:51.244959116 CET	192.168.2.6	1.1.1.1	0xbbb3	Standard query (0)	ymmcwogyimsuqmcc.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:51.489162922 CET	192.168.2.6	1.1.1.1	0x5b67	Standard query (0)	osmoygyawqmmimkq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:51.735234022 CET	192.168.2.6	1.1.1.1	0xae62	Standard query (0)	immyecuqwkiyscys.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:52.116364002 CET	192.168.2.6	1.1.1.1	0xae62	Standard query (0)	immyecuqwkiyscys.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:52.126744032 CET	192.168.2.6	1.1.1.1	0xe829	Standard query (0)	omsqkuiwcwoegooq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:52.458657980 CET	192.168.2.6	1.1.1.1	0xfe63	Standard query (0)	ukaiiiyqoooycyqm.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:52.678318024 CET	192.168.2.6	1.1.1.1	0x4405	Standard query (0)	isemauqkwwiumyky.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:52.930201054 CET	192.168.2.6	1.1.1.1	0xbd8c	Standard query (0)	keguuyioweymiaws.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:53.239197969 CET	192.168.2.6	1.1.1.1	0x1b75	Standard query (0)	kwaywmaequkqccai.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:53.466754913 CET	192.168.2.6	1.1.1.1	0xda5a	Standard query (0)	yyimcoiwgckeakcm.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:53.696007967 CET	192.168.2.6	1.1.1.1	0x3f68	Standard query (0)	ekcwemuekgqsimae.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:53.938606024 CET	192.168.2.6	1.1.1.1	0xa591	Standard query (0)	imigkomgmqgmakqk.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:54.188436985 CET	192.168.2.6	1.1.1.1	0x58ae	Standard query (0)	omasqkwqyskcagwi.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:54.437866926 CET	192.168.2.6	1.1.1.1	0xfaa7	Standard query (0)	awyomscgweuqmgaw.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:54.668432951 CET	192.168.2.6	1.1.1.1	0x74d5	Standard query (0)	eyoyssauceguqwmk.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:54.910494089 CET	192.168.2.6	1.1.1.1	0x3eef	Standard query (0)	gwwcqeykmseicgaw.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:55.225720882 CET	192.168.2.6	1.1.1.1	0x69ef	Standard query (0)	qwywqgsmgaoiwsga.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:55.600123882 CET	192.168.2.6	1.1.1.1	0x64d0	Standard query (0)	ososwckwcqmmwqcy.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:55.910928965 CET	192.168.2.6	1.1.1.1	0x4a41	Standard query (0)	osaymwoggqqycmse.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:56.147093058 CET	192.168.2.6	1.1.1.1	0xdea3	Standard query (0)	oyewqwkusieeoqey.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:56.458784103 CET	192.168.2.6	1.1.1.1	0x7e29	Standard query (0)	ommwaqgaemsmcqwc.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:56.699390888 CET	192.168.2.6	1.1.1.1	0x2522	Standard query (0)	cauewwukyywyqiei.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:57.008605003 CET	192.168.2.6	1.1.1.1	0xc086	Standard query (0)	goeykqccmemkswom.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:57.245102882 CET	192.168.2.6	1.1.1.1	0xbf81	Standard query (0)	aksuakswwkiimamq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:57.471926928 CET	192.168.2.6	1.1.1.1	0x925a	Standard query (0)	isaeicumkcuwqmqq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:57.715126038 CET	192.168.2.6	1.1.1.1	0xc0f6	Standard query (0)	qiswokuokugiooky.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:58.028471947 CET	192.168.2.6	1.1.1.1	0x1ccf	Standard query (0)	qiswcssocuqsaqkq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:58.340850115 CET	192.168.2.6	1.1.1.1	0xbd45	Standard query (0)	qcyksokwumicscaa.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:58.671828032 CET	192.168.2.6	1.1.1.1	0x1dec	Standard query (0)	esiaisyasoaoqwki.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:58.981062889 CET	192.168.2.6	1.1.1.1	0x154e	Standard query (0)	giqukkwwcwgqcisg.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:59.203973055 CET	192.168.2.6	1.1.1.1	0x8034	Standard query (0)	ymqaaskiwomkucuy.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:59.439290047 CET	192.168.2.6	1.1.1.1	0xf38e	Standard query (0)	akueuaicusaoieiy.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:59.671089888 CET	192.168.2.6	1.1.1.1	0xd2ac	Standard query (0)	sauygqecsusickcu.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:59.904417038 CET	192.168.2.6	1.1.1.1	0x9e39	Standard query (0)	kkwkgmcoawgaoiwg.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:00.217678070 CET	192.168.2.6	1.1.1.1	0x575f	Standard query (0)	saumycuogqsqykes.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:00.471667051 CET	192.168.2.6	1.1.1.1	0x8832	Standard query (0)	ukyokaigmmkumgoa.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:00.782411098 CET	192.168.2.6	1.1.1.1	0x8328	Standard query (0)	eswweuycwwiiykwo.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:01.028171062 CET	192.168.2.6	1.1.1.1	0x54ac	Standard query (0)	uksgyqiqaaiaiesi.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:01.296113014 CET	192.168.2.6	1.1.1.1	0xd9	Standard query (0)	smckcsaioceiyasu.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:01.547884941 CET	192.168.2.6	1.1.1.1	0x6389	Standard query (0)	esimsqgcwwwmyoqc.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:01.908490896 CET	192.168.2.6	1.1.1.1	0x6389	Standard query (0)	esimsqgcwwwmyoqc.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:01.985766888 CET	192.168.2.6	1.1.1.1	0x521f	Standard query (0)	maiyuocqqiqiiskw.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:02.250134945 CET	192.168.2.6	1.1.1.1	0x558	Standard query (0)	smaaowemwiwggocu.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:02.481414080 CET	192.168.2.6	1.1.1.1	0x16ed	Standard query (0)	kwuuwgemogmuomwq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:02.734766006 CET	192.168.2.6	1.1.1.1	0x668d	Standard query (0)	ukicsmiwggcwksam.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:02.974865913 CET	192.168.2.6	1.1.1.1	0x45d3	Standard query (0)	gwamoggwyegsseao.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:03.213344097 CET	192.168.2.6	1.1.1.1	0x8d9a	Standard query (0)	immcqsiceooqyaay.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:03.456264973 CET	192.168.2.6	1.1.1.1	0x5d02	Standard query (0)	kkcqgowgkcoyokcu.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:03.699150085 CET	192.168.2.6	1.1.1.1	0x2c7a	Standard query (0)	kecgikusmakuksma.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:03.947475910 CET	192.168.2.6	1.1.1.1	0x9013	Standard query (0)	ymuiggyusggsymoi.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:04.189583063 CET	192.168.2.6	1.1.1.1	0x6099	Standard query (0)	uecouukwkuceyuwg.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:04.447952032 CET	192.168.2.6	1.1.1.1	0x5db7	Standard query (0)	eyoaceoookqskqmy.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:04.677423954 CET	192.168.2.6	1.1.1.1	0x92c5	Standard query (0)	awwomgcseeqwkkom.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:05.010627031 CET	192.168.2.6	1.1.1.1	0xfb46	Standard query (0)	keykoekseemyiewq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:05.247859001 CET	192.168.2.6	1.1.1.1	0x3e4f	Standard query (0)	ysiwwoeeaaskykaw.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:05.556890965 CET	192.168.2.6	1.1.1.1	0xc1f2	Standard query (0)	kwmcuwccqmuecgea.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:05.792088032 CET	192.168.2.6	1.1.1.1	0x7aa3	Standard query (0)	gwyooeiscmwguqms.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:06.018018007 CET	192.168.2.6	1.1.1.1	0x332a	Standard query (0)	wuokiysmiucoucak.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:06.340368032 CET	192.168.2.6	1.1.1.1	0x2843	Standard query (0)	wuuiumemmigyyauq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:06.655307055 CET	192.168.2.6	1.1.1.1	0x6cf2	Standard query (0)	acwomuuukiomgqkm.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:06.875865936 CET	192.168.2.6	1.1.1.1	0xc457	Standard query (0)	muwqwgaaymomgwmi.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:07.198827028 CET	192.168.2.6	1.1.1.1	0x7b38	Standard query (0)	omgcoecwsqiuqyug.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:07.459960938 CET	192.168.2.6	1.1.1.1	0xdf36	Standard query (0)	kqmsgskwgemyueya.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:07.715811014 CET	192.168.2.6	1.1.1.1	0x62cc	Standard query (0)	eyiyueewuaqmmwcm.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:07.964306116 CET	192.168.2.6	1.1.1.1	0x9775	Standard query (0)	gwoyamckoqoaauoq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:08.335654974 CET	192.168.2.6	1.1.1.1	0x9775	Standard query (0)	gwoyamckoqoaauoq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:08.351620913 CET	192.168.2.6	1.1.1.1	0x3c5a	Standard query (0)	qwqsoyoqkymakowm.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:08.591502905 CET	192.168.2.6	1.1.1.1	0x94b8	Standard query (0)	gcmiymmqgwuquokm.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:08.842700958 CET	192.168.2.6	1.1.1.1	0xedf0	Standard query (0)	ymseciekayuweoww.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:09.090524912 CET	192.168.2.6	1.1.1.1	0x12c9	Standard query (0)	oyocwswugeiqqyoo.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:09.341471910 CET	192.168.2.6	1.1.1.1	0x1e44	Standard query (0)	omgooecquoweeomo.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:09.584546089 CET	192.168.2.6	1.1.1.1	0x743d	Standard query (0)	imgeoyougkmmeuec.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:09.825234890 CET	192.168.2.6	1.1.1.1	0x78b3	Standard query (0)	smoswyoekkccyuga.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:10.063687086 CET	192.168.2.6	1.1.1.1	0xffb2	Standard query (0)	suwkomiqcykeyako.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:10.381644011 CET	192.168.2.6	1.1.1.1	0x3108	Standard query (0)	smwsugycuuckemue.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:10.633656025 CET	192.168.2.6	1.1.1.1	0x9b26	Standard query (0)	qigcqiaomwieqwka.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:11.881622076 CET	192.168.2.6	1.1.1.1	0x9b26	Standard query (0)	qigcqiaomwieqwka.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:11.909925938 CET	192.168.2.6	1.1.1.1	0xee06	Standard query (0)	oekcyqqggaegsesm.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:12.146327019 CET	192.168.2.6	1.1.1.1	0xa2eb	Standard query (0)	qcoysaaooaiccqyu.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:12.402265072 CET	192.168.2.6	1.1.1.1	0xc3d8	Standard query (0)	mismuqiygyeysaoo.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:12.634340048 CET	192.168.2.6	1.1.1.1	0x9de6	Standard query (0)	wockoyekyageakcg.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:12.877840042 CET	192.168.2.6	1.1.1.1	0x233d	Standard query (0)	ososokqeakgguwsq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:13.105410099 CET	192.168.2.6	1.1.1.1	0xca31	Standard query (0)	wcgqccqcugomywua.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:13.424015999 CET	192.168.2.6	1.1.1.1	0xa849	Standard query (0)	aqaqgemescmwsqks.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:13.735666037 CET	192.168.2.6	1.1.1.1	0x5419	Standard query (0)	aqiwocaywcswuwsq.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:13.976507902 CET	192.168.2.6	1.1.1.1	0x8d6d	Standard query (0)	aqgmgoqcoqqkguyk.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:14.214147091 CET	192.168.2.6	1.1.1.1	0x7501	Standard query (0)	oywgqkusocouysua.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:14.448784113 CET	192.168.2.6	1.1.1.1	0xccb6	Standard query (0)	uyygagweoagcuqky.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:14.680834055 CET	192.168.2.6	1.1.1.1	0x4ab7	Standard query (0)	muiccguyaeaqwweg.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:14.925415993 CET	192.168.2.6	1.1.1.1	0x5651	Standard query (0)	qiqueqokwqqgwwci.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:15.159195900 CET	192.168.2.6	1.1.1.1	0x4ee	Standard query (0)	uygmgoymcwcgkios.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:15.473614931 CET	192.168.2.6	1.1.1.1	0xacc4	Standard query (0)	qiyggmguowygeooc.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:15.707961082 CET	192.168.2.6	1.1.1.1	0xb130	Standard query (0)	acacoiqgoimayqwm.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:15.967694998 CET	192.168.2.6	1.1.1.1	0xd08f	Standard query (0)	smisyqewaummmwoc.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 25, 2024 07:42:03.725416899 CET	1.1.1.1	192.168.2.6	0x3343	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 07:42:03.725416899 CET	1.1.1.1	192.168.2.6	0x3343	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:44.405325890 CET	1.1.1.1	192.168.2.6	0x3aa2	No error (0)	keoqiqigggqkcykq.xyz		31.192.232.92	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:44.663211107 CET	1.1.1.1	192.168.2.6	0x2f7f	Name error (3)	kqsamcsauqiagmma.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:44.908363104 CET	1.1.1.1	192.168.2.6	0x1b53	Name error (3)	mocikyoeikocwkuc.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:45.143069029 CET	1.1.1.1	192.168.2.6	0x8e75	Name error (3)	uymiagmwmqmimewm.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:45.772722006 CET	1.1.1.1	192.168.2.6	0x8dfd	Name error (3)	gcikuiqswcgsscog.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:46.057715893 CET	1.1.1.1	192.168.2.6	0xd346	Name error (3)	qwmaokcmiwuqqyes.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:46.417078972 CET	1.1.1.1	192.168.2.6	0x4c77	Name error (3)	igaiseoqksuoukqg.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:46.652769089 CET	1.1.1.1	192.168.2.6	0xd216	Name error (3)	kqukwaogqoucsaas.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:46.880230904 CET	1.1.1.1	192.168.2.6	0x1306	Name error (3)	miacggmycyqikoyq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:47.108027935 CET	1.1.1.1	192.168.2.6	0x9b49	Name error (3)	woceumwmwioocusa.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:47.419380903 CET	1.1.1.1	192.168.2.6	0x9dc4	Name error (3)	acgcaiyykiigugms.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:47.734921932 CET	1.1.1.1	192.168.2.6	0xdd7e	Name error (3)	cogsyycsuwoysugi.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:47.975377083 CET	1.1.1.1	192.168.2.6	0x5267	Name error (3)	oekyamueeiiousia.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:48.209748030 CET	1.1.1.1	192.168.2.6	0xc806	Name error (3)	wukaqiusicksuguo.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:48.461339951 CET	1.1.1.1	192.168.2.6	0x1b9d	Name error (3)	yyusosuyycoeikgo.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:48.772095919 CET	1.1.1.1	192.168.2.6	0x8895	Name error (3)	kqoceoymymoicqky.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:49.026596069 CET	1.1.1.1	192.168.2.6	0x323f	Name error (3)	uykkwkqqemamguwa.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:49.621525049 CET	1.1.1.1	192.168.2.6	0xbb0c	Name error (3)	oyekqyccewougasu.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:49.860989094 CET	1.1.1.1	192.168.2.6	0xdd53	Name error (3)	ymsaymyugccysmow.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:50.175507069 CET	1.1.1.1	192.168.2.6	0xba84	Name error (3)	omuquowgiusiesgk.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:50.486675978 CET	1.1.1.1	192.168.2.6	0x6936	Name error (3)	wiywykakusaygisc.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:50.805180073 CET	1.1.1.1	192.168.2.6	0x38a6	Name error (3)	aqmqywkwsmmayyoi.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:51.117918968 CET	1.1.1.1	192.168.2.6	0x2558	Name error (3)	cuccygameukkeumw.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:51.357064962 CET	1.1.1.1	192.168.2.6	0xae3e	Name error (3)	ukekykoqskumoikg.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:51.593477011 CET	1.1.1.1	192.168.2.6	0x358f	Name error (3)	uyqcacmsiquuwggq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:51.823498964 CET	1.1.1.1	192.168.2.6	0xf99a	Name error (3)	ysoqqwckkqssyigm.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:52.054591894 CET	1.1.1.1	192.168.2.6	0x3f6d	Name error (3)	yyemsyoimicqmais.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:52.314260006 CET	1.1.1.1	192.168.2.6	0xcd23	Name error (3)	miigookwguakmkeu.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:52.628350019 CET	1.1.1.1	192.168.2.6	0x3707	Name error (3)	qiuswcgwaqgemwcg.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:52.860569000 CET	1.1.1.1	192.168.2.6	0xc2b7	Name error (3)	wuusiiukmwcmimyk.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:53.101443052 CET	1.1.1.1	192.168.2.6	0x7b7e	Name error (3)	uqyukkamycuaimsu.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:53.328497887 CET	1.1.1.1	192.168.2.6	0x15d5	Name error (3)	woeamasicuiqyckq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:53.637305975 CET	1.1.1.1	192.168.2.6	0x3556	Name error (3)	akaueuwoocwkkoya.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:53.892999887 CET	1.1.1.1	192.168.2.6	0xe51f	Name error (3)	qciqgoeogwwmwkcw.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:54.213109970 CET	1.1.1.1	192.168.2.6	0xed96	Name error (3)	ucwesqiquqggymqe.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:54.833137989 CET	1.1.1.1	192.168.2.6	0x82da	Name error (3)	mgseamqmgkqcuewy.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:55.152791977 CET	1.1.1.1	192.168.2.6	0x51d1	Name error (3)	gaoweoyqcuuykwgu.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:55.402666092 CET	1.1.1.1	192.168.2.6	0x8441	Name error (3)	oqegmuqkgyaywwmc.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:55.640198946 CET	1.1.1.1	192.168.2.6	0x9388	Name error (3)	qusmiuqmmgqsgeci.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:55.879942894 CET	1.1.1.1	192.168.2.6	0x767d	Name error (3)	yqcakkmwigkaumii.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:56.130148888 CET	1.1.1.1	192.168.2.6	0x42d5	Name error (3)	qokykyyigsyqggqe.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:56.359009027 CET	1.1.1.1	192.168.2.6	0x6124	Name error (3)	cyyyokugycioysok.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:56.582168102 CET	1.1.1.1	192.168.2.6	0x8f21	Name error (3)	iqcaysimoeeqamky.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:56.812673092 CET	1.1.1.1	192.168.2.6	0x62e1	Name error (3)	yekiwquqaacesqqq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:57.048571110 CET	1.1.1.1	192.168.2.6	0x99d8	Name error (3)	gmooqswyuuqaiomi.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:57.368793964 CET	1.1.1.1	192.168.2.6	0xe9de	Name error (3)	kuiomoiwauwckqeq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:57.681859970 CET	1.1.1.1	192.168.2.6	0x9712	Name error (3)	ceucuuwiwwuiweaq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:57.923152924 CET	1.1.1.1	192.168.2.6	0x894e	Name error (3)	cycscsqyqkeaykgc.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:58.160433054 CET	1.1.1.1	192.168.2.6	0xfc58	Name error (3)	ssagiiaauyewiswa.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:58.387115955 CET	1.1.1.1	192.168.2.6	0x11d8	Name error (3)	ggwsuoyyioagegkw.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:58.700515985 CET	1.1.1.1	192.168.2.6	0xdd12	Name error (3)	ieikmuieoqqmugwu.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:58.938034058 CET	1.1.1.1	192.168.2.6	0xf999	Name error (3)	kcqkucqkogqiuukw.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:59.176297903 CET	1.1.1.1	192.168.2.6	0xbe41	Name error (3)	oqouwceoowyiwgag.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:59.402385950 CET	1.1.1.1	192.168.2.6	0x5aa2	Name error (3)	gakowseyscmeqkya.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:59.638278961 CET	1.1.1.1	192.168.2.6	0xb66c	Name error (3)	quisoakcuqsygyyc.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:42:59.952807903 CET	1.1.1.1	192.168.2.6	0x7718	Name error (3)	auuisqaykqgeesae.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:00.263302088 CET	1.1.1.1	192.168.2.6	0x8dfb	Name error (3)	iyawyckqggkwsyoq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:00.525245905 CET	1.1.1.1	192.168.2.6	0x8099	Name error (3)	ecmyomcaicqysoqw.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:00.807523012 CET	1.1.1.1	192.168.2.6	0x61b0	Name error (3)	iqcqqquiwomgsmma.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:01.048680067 CET	1.1.1.1	192.168.2.6	0x522e	Name error (3)	ssegwgieumyoasym.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:01.295047045 CET	1.1.1.1	192.168.2.6	0x7786	Name error (3)	ceeomiecgymecgau.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:01.537347078 CET	1.1.1.1	192.168.2.6	0xa807	Name error (3)	myisokqwsmqeusuy.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:01.856120110 CET	1.1.1.1	192.168.2.6	0xb2c0	Name error (3)	ywkamsiogkycyosy.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:02.173403978 CET	1.1.1.1	192.168.2.6	0xb985	Name error (3)	ggkyecqguqkkuoso.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:02.362637043 CET	1.1.1.1	192.168.2.6	0x1c99	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 07:43:02.362637043 CET	1.1.1.1	192.168.2.6	0x1c99	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:02.362637043 CET	1.1.1.1	192.168.2.6	0x1c99	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:02.414078951 CET	1.1.1.1	192.168.2.6	0xd9a4	Name error (3)	kcyoeiykekuqkkmg.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:02.651428938 CET	1.1.1.1	192.168.2.6	0x3deb	Name error (3)	ikwyuqgsegcgcccg.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:02.900804043 CET	1.1.1.1	192.168.2.6	0xd6b4	Name error (3)	wgswkwaesqqwkoaa.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:03.216351986 CET	1.1.1.1	192.168.2.6	0xae12	Name error (3)	eqkkkcuwkiqiecac.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:03.472306967 CET	1.1.1.1	192.168.2.6	0xf36b	Name error (3)	kigcewceemkckeow.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:03.760411978 CET	1.1.1.1	192.168.2.6	0x54bc	Name error (3)	ykaimcgigakggwec.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:04.115869999 CET	1.1.1.1	192.168.2.6	0x13a8	Name error (3)	uceaygkekiassamu.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:04.345221043 CET	1.1.1.1	192.168.2.6	0xdc61	Name error (3)	seioywksogeseqig.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:04.570444107 CET	1.1.1.1	192.168.2.6	0x2252	Name error (3)	ssoqscyewimqiqme.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:04.815239906 CET	1.1.1.1	192.168.2.6	0x8bf5	Name error (3)	kocgeaeoakgqewog.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:05.062884092 CET	1.1.1.1	192.168.2.6	0x15fa	Name error (3)	kuiqsugkqeoscguo.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:05.373590946 CET	1.1.1.1	192.168.2.6	0xe3ae	Name error (3)	kcsqwmkusesaccwa.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:05.620500088 CET	1.1.1.1	192.168.2.6	0xd791	Name error (3)	ywyawywiuyecuiuu.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:05.845906973 CET	1.1.1.1	192.168.2.6	0xf5b5	Name error (3)	uowowiqiyeiuwmcc.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:06.072746992 CET	1.1.1.1	192.168.2.6	0x3f27	Name error (3)	uokqeaieowiogsgc.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:06.327953100 CET	1.1.1.1	192.168.2.6	0xbf61	Name error (3)	ikoqkscwsowwukmi.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:06.571243048 CET	1.1.1.1	192.168.2.6	0x5712	Name error (3)	iymukyseoieqccac.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:06.881623983 CET	1.1.1.1	192.168.2.6	0x5b28	Name error (3)	qascmswkaisogoaq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:07.122221947 CET	1.1.1.1	192.168.2.6	0x5710	Name error (3)	gacgceaygaecuguy.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:07.359385014 CET	1.1.1.1	192.168.2.6	0xfa8b	Name error (3)	eqyyguuwsyqaqgsq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:07.597616911 CET	1.1.1.1	192.168.2.6	0x1600	Name error (3)	ewywcoeukaoaegci.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:07.838146925 CET	1.1.1.1	192.168.2.6	0x3cbd	Name error (3)	mmygsewuukqkiiok.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:08.081338882 CET	1.1.1.1	192.168.2.6	0xa25f	Name error (3)	wgyimykogekgewoa.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:08.329633951 CET	1.1.1.1	192.168.2.6	0xeb69	Name error (3)	uiguoqqagkiuagyc.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:08.575721025 CET	1.1.1.1	192.168.2.6	0xe12f	Name error (3)	kcesagqugouwkqyg.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:08.809726000 CET	1.1.1.1	192.168.2.6	0x94c9	Name error (3)	yqeugeoquqsokgqk.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:09.035053968 CET	1.1.1.1	192.168.2.6	0xce73	Name error (3)	eigkgwkyuqssgamw.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:09.347517014 CET	1.1.1.1	192.168.2.6	0xd9e1	Name error (3)	waqmyueimmyiuawq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:09.596386909 CET	1.1.1.1	192.168.2.6	0x985a	Name error (3)	qgukewuuykmmkgeq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:09.827820063 CET	1.1.1.1	192.168.2.6	0x9757	Name error (3)	gmwcscokucowyogs.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:10.081800938 CET	1.1.1.1	192.168.2.6	0xfe28	Name error (3)	ywegqamoegumacgi.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:10.393402100 CET	1.1.1.1	192.168.2.6	0x3a9c	Name error (3)	yquocucuqoywwcsu.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:10.705668926 CET	1.1.1.1	192.168.2.6	0xc079	Name error (3)	eqmeimmouegoasay.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:10.947154999 CET	1.1.1.1	192.168.2.6	0x10a	Name error (3)	cykgmsqcgysgaioo.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:11.187079906 CET	1.1.1.1	192.168.2.6	0xf254	Name error (3)	oqoemaogyoikomiy.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:11.425141096 CET	1.1.1.1	192.168.2.6	0x22e9	Name error (3)	qoiiomimuoaqgeku.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:11.665942907 CET	1.1.1.1	192.168.2.6	0x3abb	Name error (3)	wgymkeismmiemsqq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:11.917234898 CET	1.1.1.1	192.168.2.6	0x8669	Name error (3)	ykocagogmeiwmymy.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:12.149837017 CET	1.1.1.1	192.168.2.6	0xb0de	Name error (3)	csoqiicgaaiyyoom.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:12.391664982 CET	1.1.1.1	192.168.2.6	0x6438	Name error (3)	koioiiwouukqousy.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:12.894018888 CET	1.1.1.1	192.168.2.6	0x3e18	Name error (3)	okkyekwuommcicqi.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:13.181128025 CET	1.1.1.1	192.168.2.6	0x229b	Name error (3)	ecacmycegqoaquio.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:13.417880058 CET	1.1.1.1	192.168.2.6	0xd5a8	Name error (3)	skgcsksqyekiymii.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:13.647361040 CET	1.1.1.1	192.168.2.6	0xb3bc	Name error (3)	kckcekceqgcyqcsa.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:13.874398947 CET	1.1.1.1	192.168.2.6	0xe054	Name error (3)	uoaeyoycyycqkoci.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:14.116621017 CET	1.1.1.1	192.168.2.6	0x4213	Name error (3)	wsaekoiomeagsaes.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:14.431859970 CET	1.1.1.1	192.168.2.6	0x6a53	Name error (3)	iqmeccigieosgmwq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:14.673240900 CET	1.1.1.1	192.168.2.6	0x4bcb	Name error (3)	ggeqowwmmmeekigg.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:14.923985958 CET	1.1.1.1	192.168.2.6	0xbd89	Name error (3)	sssawsmmkmuyqsaq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:15.234641075 CET	1.1.1.1	192.168.2.6	0x997b	Name error (3)	ecmckkeyoskcigeu.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:15.460077047 CET	1.1.1.1	192.168.2.6	0xe747	Name error (3)	quoqoooiamqkkosc.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:15.706433058 CET	1.1.1.1	192.168.2.6	0xd5	Name error (3)	waokmuyyeooamowm.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:15.998867989 CET	1.1.1.1	192.168.2.6	0x2809	Name error (3)	ykomskascimimomo.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:16.453465939 CET	1.1.1.1	192.168.2.6	0x4dba	Name error (3)	mmisquwegymayaee.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:16.693351030 CET	1.1.1.1	192.168.2.6	0xe18b	Name error (3)	mmyukmsqamgicqai.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:17.006175041 CET	1.1.1.1	192.168.2.6	0x5f90	Name error (3)	ikwyooieywakeqog.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:17.239398956 CET	1.1.1.1	192.168.2.6	0xdcbc	Name error (3)	mgwmkyyqckeewgce.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:17.551119089 CET	1.1.1.1	192.168.2.6	0x2e8f	Name error (3)	owoksuegymmgesys.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:17.864094019 CET	1.1.1.1	192.168.2.6	0xdd03	Name error (3)	aamuskacaaiycguu.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:18.098277092 CET	1.1.1.1	192.168.2.6	0x601b	Name error (3)	yegskieoocgoamyi.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:18.335284948 CET	1.1.1.1	192.168.2.6	0xebe	Name error (3)	aaiouwywwcwuuasm.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:19.057938099 CET	1.1.1.1	192.168.2.6	0x2d37	Name error (3)	kuoqgwooymgsqaum.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:19.352587938 CET	1.1.1.1	192.168.2.6	0x95af	Name error (3)	myoyccuwcyaygceg.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:19.663105965 CET	1.1.1.1	192.168.2.6	0x87cb	Name error (3)	ggqgwuaseamkyywa.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:19.909269094 CET	1.1.1.1	192.168.2.6	0xb176	Name error (3)	uwimwwicgcscuoku.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:20.224685907 CET	1.1.1.1	192.168.2.6	0x44af	Name error (3)	cyyukyomsoiqyyqa.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:20.462007999 CET	1.1.1.1	192.168.2.6	0x8769	Name error (3)	gaisoawuoicqsumy.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:20.690298080 CET	1.1.1.1	192.168.2.6	0x5603	Name error (3)	qogsmcecyusiyaim.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:20.922532082 CET	1.1.1.1	192.168.2.6	0xeec2	Name error (3)	ykqocceawkwoagmc.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:21.239236116 CET	1.1.1.1	192.168.2.6	0xe2f5	Name error (3)	aosywgkogcissggi.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:21.484021902 CET	1.1.1.1	192.168.2.6	0x638f	Name error (3)	ieywwkeuouoqgqms.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:21.716784000 CET	1.1.1.1	192.168.2.6	0x5cf8	Name error (3)	ecgkeyeueawgcuqo.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:22.007155895 CET	1.1.1.1	192.168.2.6	0xc8ec	Name error (3)	guimuaoiecmouigq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:22.380822897 CET	1.1.1.1	192.168.2.6	0x5e64	Name error (3)	ggkyuooyikmqoscw.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:22.750464916 CET	1.1.1.1	192.168.2.6	0x8030	Name error (3)	uoeeuiaewmogugeo.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:22.988456964 CET	1.1.1.1	192.168.2.6	0x4781	Name error (3)	okgeqaswygsgykme.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:23.231245995 CET	1.1.1.1	192.168.2.6	0x6f74	Name error (3)	ywqiciegywcouoiy.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:23.546083927 CET	1.1.1.1	192.168.2.6	0x82f0	Name error (3)	qgkgogieieoomkqq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:23.856034994 CET	1.1.1.1	192.168.2.6	0xd3a1	Name error (3)	qgkmsekougssaawq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:24.166810989 CET	1.1.1.1	192.168.2.6	0x227	Name error (3)	ggmwwewskeiggosq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:24.413969994 CET	1.1.1.1	192.168.2.6	0x2aab	Name error (3)	eqgwaamacqweiwie.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:24.658035994 CET	1.1.1.1	192.168.2.6	0xde5a	Name error (3)	wmqcgwcegsomeqas.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:24.901818037 CET	1.1.1.1	192.168.2.6	0xbd75	Name error (3)	oqummowmqwcgsegm.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:25.151554108 CET	1.1.1.1	192.168.2.6	0x78ad	Name error (3)	qoowyoueaaaccgqs.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:25.559406996 CET	1.1.1.1	192.168.2.6	0xa43	Name error (3)	csiykwakekqoqaym.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:25.813433886 CET	1.1.1.1	192.168.2.6	0xc67e	Name error (3)	mmymmauyiiksiugu.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:26.043581963 CET	1.1.1.1	192.168.2.6	0xb983	Name error (3)	cseksqccmgaieyic.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:26.358818054 CET	1.1.1.1	192.168.2.6	0xbc8	Name error (3)	cykgucwkesokooyw.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:26.597244024 CET	1.1.1.1	192.168.2.6	0x807a	Name error (3)	okoguckagygoqqgk.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:26.823875904 CET	1.1.1.1	192.168.2.6	0x74a8	Name error (3)	cyswykkcmggyiqwo.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:27.057318926 CET	1.1.1.1	192.168.2.6	0xfff7	Name error (3)	gmmacaiigwcscggs.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:27.301233053 CET	1.1.1.1	192.168.2.6	0x304	Name error (3)	yequgaccqouegcmw.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:27.535701036 CET	1.1.1.1	192.168.2.6	0x6cbc	Name error (3)	sksiyqgummyycgmi.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:27.849803925 CET	1.1.1.1	192.168.2.6	0xb78d	Name error (3)	skekiggeimmceqcg.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:28.107491016 CET	1.1.1.1	192.168.2.6	0x69a1	Name error (3)	eiqqequeskcqiqmw.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:28.364573002 CET	1.1.1.1	192.168.2.6	0xf1d4	Name error (3)	ecsamoyaimquqwow.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:28.729388952 CET	1.1.1.1	192.168.2.6	0x5765	Name error (3)	aiyksmkyqgyaemiw.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:29.008758068 CET	1.1.1.1	192.168.2.6	0xc10e	Name error (3)	owewoieiwasaueco.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:29.318506002 CET	1.1.1.1	192.168.2.6	0x141b	Name error (3)	aoymcmmeqqqgwwca.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:29.630239010 CET	1.1.1.1	192.168.2.6	0xd61d	Name error (3)	iygsiugeeogoeiyi.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:29.944799900 CET	1.1.1.1	192.168.2.6	0x9299	Name error (3)	quuemeewaqaiiyqc.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:30.200145006 CET	1.1.1.1	192.168.2.6	0x95a9	Name error (3)	wggikwiqowiwqcqg.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:30.436234951 CET	1.1.1.1	192.168.2.6	0x68e0	Name error (3)	ucuiiwcwwgimkyyi.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:30.660789013 CET	1.1.1.1	192.168.2.6	0xc093	Name error (3)	koiugmaqgkawaiyw.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:30.901300907 CET	1.1.1.1	192.168.2.6	0x501	Name error (3)	waeqkmeeasauygum.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:31.147852898 CET	1.1.1.1	192.168.2.6	0xbe20	Name error (3)	ecimsaauyieykegi.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:31.385229111 CET	1.1.1.1	192.168.2.6	0x7837	Name error (3)	ocsqocikkcggeaaw.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:31.636288881 CET	1.1.1.1	192.168.2.6	0xc4	Name error (3)	iyaqqeamygmakcgo.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:31.873076916 CET	1.1.1.1	192.168.2.6	0x951f	Name error (3)	uowgcyqcgaqiumoi.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:32.144113064 CET	1.1.1.1	192.168.2.6	0x8272	Name error (3)	myymasomksgeawqw.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:32.377203941 CET	1.1.1.1	192.168.2.6	0xe508	Name error (3)	myaueqycgeikwagc.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:32.688980103 CET	1.1.1.1	192.168.2.6	0xbe47	Name error (3)	seoomaqwwimwueiw.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:32.924922943 CET	1.1.1.1	192.168.2.6	0xa3c8	Name error (3)	mgeycqkiwggsymyc.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:33.156320095 CET	1.1.1.1	192.168.2.6	0xccab	Name error (3)	ikgkgaaqqsmomuim.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:33.394998074 CET	1.1.1.1	192.168.2.6	0xe4d3	Name error (3)	ieuaeqceycqyqygk.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:33.709239006 CET	1.1.1.1	192.168.2.6	0x40cb	Name error (3)	waeqwwagawqkksya.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:33.949033022 CET	1.1.1.1	192.168.2.6	0xa22b	Name error (3)	mmeuqmoaekswggoe.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:34.265642881 CET	1.1.1.1	192.168.2.6	0x13ba	Name error (3)	ucyoqcksaiiwgqae.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:34.549222946 CET	1.1.1.1	192.168.2.6	0x1da3	Name error (3)	aoosomigeaiewqom.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:34.872266054 CET	1.1.1.1	192.168.2.6	0xd1ad	Name error (3)	cyqaqqcqamemsiog.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:35.102586985 CET	1.1.1.1	192.168.2.6	0xd1ad	Name error (3)	cyqaqqcqamemsiog.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:35.301449060 CET	1.1.1.1	192.168.2.6	0x61fe	Name error (3)	wacqigcacsemkyos.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:35.527666092 CET	1.1.1.1	192.168.2.6	0x312e	Name error (3)	yqocoeikiyacyuck.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:35.837469101 CET	1.1.1.1	192.168.2.6	0xcc03	Name error (3)	ywcuqkkmmqioiwqk.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:36.083643913 CET	1.1.1.1	192.168.2.6	0xada7	Name error (3)	waqcciyigkuoygqy.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:36.318451881 CET	1.1.1.1	192.168.2.6	0x882	Name error (3)	ceoqyeiycqkumwao.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:36.552597046 CET	1.1.1.1	192.168.2.6	0xd088	Name error (3)	aauquiiqeugcwswc.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:37.045686007 CET	1.1.1.1	192.168.2.6	0xf9e8	Name error (3)	uoeiymqawsqiyuck.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:37.061218977 CET	1.1.1.1	192.168.2.6	0xf9e8	Name error (3)	uoeiymqawsqiyuck.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:37.273227930 CET	1.1.1.1	192.168.2.6	0x4996	Name error (3)	yqceweqmaumwwywy.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:37.501923084 CET	1.1.1.1	192.168.2.6	0x6503	Name error (3)	eqmycgagykgkqwsu.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:37.741780043 CET	1.1.1.1	192.168.2.6	0xebe9	Name error (3)	seuuicaewuoaumes.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:38.025662899 CET	1.1.1.1	192.168.2.6	0xaee2	Name error (3)	aomaeyokqgsuomii.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:38.274369001 CET	1.1.1.1	192.168.2.6	0xadf7	Name error (3)	waqucgoeeeeymeii.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:38.499217987 CET	1.1.1.1	192.168.2.6	0x3e15	Name error (3)	oqacqgmiaaewmmey.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:38.750020981 CET	1.1.1.1	192.168.2.6	0x6351	Name error (3)	ykeaoyaycoiamqey.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:38.992010117 CET	1.1.1.1	192.168.2.6	0x7807	Name error (3)	csmgwcogqqcwseka.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:39.242861986 CET	1.1.1.1	192.168.2.6	0xa638	Name error (3)	auowmussgaesgwas.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:39.482786894 CET	1.1.1.1	192.168.2.6	0x670f	Name error (3)	aikmouciiqgecoqi.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:39.791871071 CET	1.1.1.1	192.168.2.6	0x7a96	Name error (3)	koecgqggegimaeya.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:40.016211033 CET	1.1.1.1	192.168.2.6	0xec83	Name error (3)	aawqwccomcemcysm.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:40.265794992 CET	1.1.1.1	192.168.2.6	0x48fe	Name error (3)	kcyakwisycecaqgw.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:40.505139112 CET	1.1.1.1	192.168.2.6	0x9eb7	Name error (3)	uogksceymossmmqc.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:40.757111073 CET	1.1.1.1	192.168.2.6	0xbb94	Name error (3)	qgmyeeguweaukuke.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:41.012825966 CET	1.1.1.1	192.168.2.6	0x6f1d	Name error (3)	mywaqkeaawisisky.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:41.329078913 CET	1.1.1.1	192.168.2.6	0x7819	Name error (3)	yqqsggacauiiugka.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:41.561973095 CET	1.1.1.1	192.168.2.6	0x37d9	Name error (3)	equmqmqwuuuioawa.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:41.886334896 CET	1.1.1.1	192.168.2.6	0xf8c0	Name error (3)	wmoamsauiwauoosg.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:42.127613068 CET	1.1.1.1	192.168.2.6	0x626c	Name error (3)	oqsakkimkesccikc.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:42.368663073 CET	1.1.1.1	192.168.2.6	0x4de	Name error (3)	mgiwaegaqyyaakwy.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:42.606513023 CET	1.1.1.1	192.168.2.6	0x1bba	Name error (3)	ucmioacycscyeouk.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:42.851171970 CET	1.1.1.1	192.168.2.6	0x64e	Name error (3)	qumaseqmggyaiauq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:43.132482052 CET	1.1.1.1	192.168.2.6	0xbe38	Name error (3)	uccyyemqaiiksuwm.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:43.388155937 CET	1.1.1.1	192.168.2.6	0x9b2a	Name error (3)	sesyieaiesegeaow.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:43.627223969 CET	1.1.1.1	192.168.2.6	0xb3da	Name error (3)	kccmicaswqmswwak.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:43.848531008 CET	1.1.1.1	192.168.2.6	0xbcff	Name error (3)	mssaogwocegysoow.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:44.101416111 CET	1.1.1.1	192.168.2.6	0x902a	Name error (3)	wssaqmakumewmaes.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:44.343830109 CET	1.1.1.1	192.168.2.6	0x6b65	Name error (3)	cmukociggiqcouio.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:44.654449940 CET	1.1.1.1	192.168.2.6	0xd48	Name error (3)	skyqsyyymyacyayc.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:44.969511032 CET	1.1.1.1	192.168.2.6	0x751b	Name error (3)	uoigsiqmemcscosu.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:45.281018972 CET	1.1.1.1	192.168.2.6	0xaad7	Name error (3)	kuywuskkgqsigqqs.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:45.514971018 CET	1.1.1.1	192.168.2.6	0x552b	Name error (3)	auayomwkewcomwas.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:45.826637030 CET	1.1.1.1	192.168.2.6	0x4777	Name error (3)	iyaikmkkowcqemsi.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:46.063884974 CET	1.1.1.1	192.168.2.6	0x120d	Name error (3)	ggicikyqcaiyguee.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:46.331485033 CET	1.1.1.1	192.168.2.6	0x1d1c	Name error (3)	oqyaoykomyoygics.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:46.632798910 CET	1.1.1.1	192.168.2.6	0xd86f	Name error (3)	eqakguiwiqacqiwg.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:46.886451006 CET	1.1.1.1	192.168.2.6	0x34e7	Name error (3)	wgcaouuqqqwucogy.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:47.197211981 CET	1.1.1.1	192.168.2.6	0xfe01	Name error (3)	ewacuagosgqmuocm.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:47.509733915 CET	1.1.1.1	192.168.2.6	0x19b5	Name error (3)	wgqyouayikuyuqmk.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:47.737200022 CET	1.1.1.1	192.168.2.6	0xff7e	Name error (3)	owaaygsacguucaye.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:48.053153038 CET	1.1.1.1	192.168.2.6	0x44b6	Name error (3)	uwgicagyykoommga.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:48.290024042 CET	1.1.1.1	192.168.2.6	0xd554	Name error (3)	uiggameqqycugsqw.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:48.601294041 CET	1.1.1.1	192.168.2.6	0x5430	Name error (3)	goguooqkgysueime.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:48.839884996 CET	1.1.1.1	192.168.2.6	0x9c90	Name error (3)	keosqeosukqcooco.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:49.162575960 CET	1.1.1.1	192.168.2.6	0x1991	Name error (3)	maoeeogmuauywsyu.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:49.439954042 CET	1.1.1.1	192.168.2.6	0xd5c4	Name error (3)	ismqaewykmoiguki.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:49.749134064 CET	1.1.1.1	192.168.2.6	0xd5cc	Name error (3)	wucwykasawokemaw.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:49.990164042 CET	1.1.1.1	192.168.2.6	0x8cf3	Name error (3)	ukmcqucewskcqygg.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:50.219743967 CET	1.1.1.1	192.168.2.6	0xb26a	Name error (3)	qqqmeagkkosgcayo.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:50.530962944 CET	1.1.1.1	192.168.2.6	0x3c63	Name error (3)	ysawassgkwqygmmq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:50.770358086 CET	1.1.1.1	192.168.2.6	0xc208	Name error (3)	osaeyoiqoqawauga.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:51.014132977 CET	1.1.1.1	192.168.2.6	0xb326	Name error (3)	iagisciiyoemgwaa.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:51.243972063 CET	1.1.1.1	192.168.2.6	0xa53d	Name error (3)	ymysimqoykwqeqiq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:51.488219023 CET	1.1.1.1	192.168.2.6	0xbbb3	Name error (3)	ymmcwogyimsuqmcc.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:51.733827114 CET	1.1.1.1	192.168.2.6	0x5b67	Name error (3)	osmoygyawqmmimkq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:52.052083969 CET	1.1.1.1	192.168.2.6	0xae62	Name error (3)	immyecuqwkiyscys.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:52.254209995 CET	1.1.1.1	192.168.2.6	0xae62	Name error (3)	immyecuqwkiyscys.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:52.390455008 CET	1.1.1.1	192.168.2.6	0xe829	Name error (3)	omsqkuiwcwoegooq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:52.677431107 CET	1.1.1.1	192.168.2.6	0xfe63	Name error (3)	ukaiiiyqoooycyqm.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:52.929383039 CET	1.1.1.1	192.168.2.6	0x4405	Name error (3)	isemauqkwwiumyky.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:53.238243103 CET	1.1.1.1	192.168.2.6	0xbd8c	Name error (3)	keguuyioweymiaws.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:53.465738058 CET	1.1.1.1	192.168.2.6	0x1b75	Name error (3)	kwaywmaequkqccai.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:53.695130110 CET	1.1.1.1	192.168.2.6	0xda5a	Name error (3)	yyimcoiwgckeakcm.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:53.937638998 CET	1.1.1.1	192.168.2.6	0x3f68	Name error (3)	ekcwemuekgqsimae.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:54.187500000 CET	1.1.1.1	192.168.2.6	0xa591	Name error (3)	imigkomgmqgmakqk.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:54.436925888 CET	1.1.1.1	192.168.2.6	0x58ae	Name error (3)	omasqkwqyskcagwi.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:54.667213917 CET	1.1.1.1	192.168.2.6	0xfaa7	Name error (3)	awyomscgweuqmgaw.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:54.909279108 CET	1.1.1.1	192.168.2.6	0x74d5	Name error (3)	eyoyssauceguqwmk.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:55.159779072 CET	1.1.1.1	192.168.2.6	0x3eef	Name error (3)	gwwcqeykmseicgaw.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:55.551537037 CET	1.1.1.1	192.168.2.6	0x69ef	Name error (3)	qwywqgsmgaoiwsga.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:55.909738064 CET	1.1.1.1	192.168.2.6	0x64d0	Name error (3)	ososwckwcqmmwqcy.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:56.146229982 CET	1.1.1.1	192.168.2.6	0x4a41	Name error (3)	osaymwoggqqycmse.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:56.457927942 CET	1.1.1.1	192.168.2.6	0xdea3	Name error (3)	oyewqwkusieeoqey.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:56.698515892 CET	1.1.1.1	192.168.2.6	0x7e29	Name error (3)	ommwaqgaemsmcqwc.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:57.007752895 CET	1.1.1.1	192.168.2.6	0x2522	Name error (3)	cauewwukyywyqiei.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:57.241225958 CET	1.1.1.1	192.168.2.6	0xc086	Name error (3)	goeykqccmemkswom.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:57.470284939 CET	1.1.1.1	192.168.2.6	0xbf81	Name error (3)	aksuakswwkiimamq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:57.714262962 CET	1.1.1.1	192.168.2.6	0x925a	Name error (3)	isaeicumkcuwqmqq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:58.027463913 CET	1.1.1.1	192.168.2.6	0xc0f6	Name error (3)	qiswokuokugiooky.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:58.269046068 CET	1.1.1.1	192.168.2.6	0x1ccf	Name error (3)	qiswcssocuqsaqkq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:58.586529016 CET	1.1.1.1	192.168.2.6	0xbd45	Name error (3)	qcyksokwumicscaa.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:58.980000019 CET	1.1.1.1	192.168.2.6	0x1dec	Name error (3)	esiaisyasoaoqwki.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:59.203002930 CET	1.1.1.1	192.168.2.6	0x154e	Name error (3)	giqukkwwcwgqcisg.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:59.438256025 CET	1.1.1.1	192.168.2.6	0x8034	Name error (3)	ymqaaskiwomkucuy.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:59.670105934 CET	1.1.1.1	192.168.2.6	0xf38e	Name error (3)	akueuaicusaoieiy.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:43:59.903414965 CET	1.1.1.1	192.168.2.6	0xd2ac	Name error (3)	sauygqecsusickcu.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:00.216659069 CET	1.1.1.1	192.168.2.6	0x9e39	Name error (3)	kkwkgmcoawgaoiwg.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:00.470738888 CET	1.1.1.1	192.168.2.6	0x575f	Name error (3)	saumycuogqsqykes.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:00.781317949 CET	1.1.1.1	192.168.2.6	0x8832	Name error (3)	ukyokaigmmkumgoa.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:01.026487112 CET	1.1.1.1	192.168.2.6	0x8328	Name error (3)	eswweuycwwiiykwo.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:01.269742966 CET	1.1.1.1	192.168.2.6	0x54ac	Name error (3)	uksgyqiqaaiaiesi.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:01.541486979 CET	1.1.1.1	192.168.2.6	0xd9	Name error (3)	smckcsaioceiyasu.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:01.786108017 CET	1.1.1.1	192.168.2.6	0x6389	Name error (3)	esimsqgcwwwmyoqc.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:02.048063993 CET	1.1.1.1	192.168.2.6	0x6389	Name error (3)	esimsqgcwwwmyoqc.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:02.249149084 CET	1.1.1.1	192.168.2.6	0x521f	Name error (3)	maiyuocqqiqiiskw.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:02.480557919 CET	1.1.1.1	192.168.2.6	0x558	Name error (3)	smaaowemwiwggocu.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:02.733845949 CET	1.1.1.1	192.168.2.6	0x16ed	Name error (3)	kwuuwgemogmuomwq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:02.974003077 CET	1.1.1.1	192.168.2.6	0x668d	Name error (3)	ukicsmiwggcwksam.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:03.211910009 CET	1.1.1.1	192.168.2.6	0x45d3	Name error (3)	gwamoggwyegsseao.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:03.455249071 CET	1.1.1.1	192.168.2.6	0x8d9a	Name error (3)	immcqsiceooqyaay.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:03.698102951 CET	1.1.1.1	192.168.2.6	0x5d02	Name error (3)	kkcqgowgkcoyokcu.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:03.946463108 CET	1.1.1.1	192.168.2.6	0x2c7a	Name error (3)	kecgikusmakuksma.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:04.188389063 CET	1.1.1.1	192.168.2.6	0x9013	Name error (3)	ymuiggyusggsymoi.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:04.435045958 CET	1.1.1.1	192.168.2.6	0x6099	Name error (3)	uecouukwkuceyuwg.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:04.675648928 CET	1.1.1.1	192.168.2.6	0x5db7	Name error (3)	eyoaceoookqskqmy.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:04.899713039 CET	1.1.1.1	192.168.2.6	0x92c5	Name error (3)	awwomgcseeqwkkom.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:05.246804953 CET	1.1.1.1	192.168.2.6	0xfb46	Name error (3)	keykoekseemyiewq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:05.555862904 CET	1.1.1.1	192.168.2.6	0x3e4f	Name error (3)	ysiwwoeeaaskykaw.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:05.790980101 CET	1.1.1.1	192.168.2.6	0xc1f2	Name error (3)	kwmcuwccqmuecgea.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:06.016784906 CET	1.1.1.1	192.168.2.6	0x7aa3	Name error (3)	gwyooeiscmwguqms.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:06.333933115 CET	1.1.1.1	192.168.2.6	0x332a	Name error (3)	wuokiysmiucoucak.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:06.654351950 CET	1.1.1.1	192.168.2.6	0x2843	Name error (3)	wuuiumemmigyyauq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:06.874938965 CET	1.1.1.1	192.168.2.6	0x6cf2	Name error (3)	acwomuuukiomgqkm.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:07.197145939 CET	1.1.1.1	192.168.2.6	0xc457	Name error (3)	muwqwgaaymomgwmi.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:07.433290958 CET	1.1.1.1	192.168.2.6	0x7b38	Name error (3)	omgcoecwsqiuqyug.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:07.705730915 CET	1.1.1.1	192.168.2.6	0xdf36	Name error (3)	kqmsgskwgemyueya.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:07.956087112 CET	1.1.1.1	192.168.2.6	0x62cc	Name error (3)	eyiyueewuaqmmwcm.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:08.196630955 CET	1.1.1.1	192.168.2.6	0x9775	Name error (3)	gwoyamckoqoaauoq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:08.476399899 CET	1.1.1.1	192.168.2.6	0x9775	Name error (3)	gwoyamckoqoaauoq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:08.590045929 CET	1.1.1.1	192.168.2.6	0x3c5a	Name error (3)	qwqsoyoqkymakowm.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:08.838795900 CET	1.1.1.1	192.168.2.6	0x94b8	Name error (3)	gcmiymmqgwuquokm.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:09.089219093 CET	1.1.1.1	192.168.2.6	0xedf0	Name error (3)	ymseciekayuweoww.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:09.340167046 CET	1.1.1.1	192.168.2.6	0x12c9	Name error (3)	oyocwswugeiqqyoo.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:09.583197117 CET	1.1.1.1	192.168.2.6	0x1e44	Name error (3)	omgooecquoweeomo.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:09.822994947 CET	1.1.1.1	192.168.2.6	0x743d	Name error (3)	imgeoyougkmmeuec.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:10.056111097 CET	1.1.1.1	192.168.2.6	0x78b3	Name error (3)	smoswyoekkccyuga.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:10.374075890 CET	1.1.1.1	192.168.2.6	0xffb2	Name error (3)	suwkomiqcykeyako.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:10.625415087 CET	1.1.1.1	192.168.2.6	0x3108	Name error (3)	smwsugycuuckemue.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:10.865286112 CET	1.1.1.1	192.168.2.6	0x9b26	Name error (3)	qigcqiaomwieqwka.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:12.018609047 CET	1.1.1.1	192.168.2.6	0x9b26	Name error (3)	qigcqiaomwieqwka.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:12.145020008 CET	1.1.1.1	192.168.2.6	0xee06	Name error (3)	oekcyqqggaegsesm.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:12.401329041 CET	1.1.1.1	192.168.2.6	0xa2eb	Name error (3)	qcoysaaooaiccqyu.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:12.632859945 CET	1.1.1.1	192.168.2.6	0xc3d8	Name error (3)	mismuqiygyeysaoo.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:12.876761913 CET	1.1.1.1	192.168.2.6	0x9de6	Name error (3)	wockoyekyageakcg.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:13.104465008 CET	1.1.1.1	192.168.2.6	0x233d	Name error (3)	ososokqeakgguwsq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:13.419819117 CET	1.1.1.1	192.168.2.6	0xca31	Name error (3)	wcgqccqcugomywua.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:13.733840942 CET	1.1.1.1	192.168.2.6	0xa849	Name error (3)	aqaqgemescmwsqks.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:13.972490072 CET	1.1.1.1	192.168.2.6	0x5419	Name error (3)	aqiwocaywcswuwsq.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:14.212250948 CET	1.1.1.1	192.168.2.6	0x8d6d	Name error (3)	aqgmgoqcoqqkguyk.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:14.447740078 CET	1.1.1.1	192.168.2.6	0x7501	Name error (3)	oywgqkusocouysua.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:14.680013895 CET	1.1.1.1	192.168.2.6	0xccb6	Name error (3)	uyygagweoagcuqky.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:14.924366951 CET	1.1.1.1	192.168.2.6	0x4ab7	Name error (3)	muiccguyaeaqwweg.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:15.158324003 CET	1.1.1.1	192.168.2.6	0x5651	Name error (3)	qiqueqokwqqgwwci.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:15.472670078 CET	1.1.1.1	192.168.2.6	0x4ee	Name error (3)	uygmgoymcwcgkios.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:15.701895952 CET	1.1.1.1	192.168.2.6	0xacc4	Name error (3)	qiyggmguowygeooc.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:15.964088917 CET	1.1.1.1	192.168.2.6	0xb130	Name error (3)	acacoiqgoimayqwm.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:44:16.276987076 CET	1.1.1.1	192.168.2.6	0xd08f	Name error (3)	smisyqewaummmwoc.xyz	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

keoqiqigggqkcykq.xyz:443

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49797	31.192.232.92	443	5588	C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:42:44.412733078 CET	130	OUT	GET /api/client_hello HTTP/1.1 Accept: / Connection: close Host: keoqiqigggqkcykq.xyz:443 User-Agent: cpp-httplib/0.12.1

Target ID:	0
Start time:	01:42:06
Start date:	25/11/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\2Wr5r2e9vo.msi"
Imagebase:	0x7ff68c5f0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	01:42:07
Start date:	25/11/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff68c5f0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	01:42:10
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding C87318A1E88CD27EAD404D332FBFE39C
Imagebase:	0x220000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	01:42:10
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
Imagebase:	0x560000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:42:10
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:42:11
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\expand.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
Imagebase:	0xd30000
File size:	53'248 bytes
MD5 hash:	544B0DBFF3F393BCE8BB9D815F532D51
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:42:11
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:42:37
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe" /VERYSILENT /VERYSILENT
Imagebase:	0x440000
File size:	688'039'936 bytes
MD5 hash:	DF5B588DABBB47648D6FEF8ABBC59064
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	27.2%
Total number of Nodes:	375
Total number of Limit Nodes:	26

Executed Functions

Function 00492A50 Relevance: 32.0, APIs: 13, Strings: 3, Instructions: 4025COMMON

Download Yara Rule

Strings

d[o[, xrefs: 00494EBB
d[o[, xrefs: 00494E82
0A], xrefs: 0049646F

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: 0A]$d[o[$d[o[
API String ID: 0-3121827694
Opcode ID: 887f4b03423070900513ffa0b71856ebf35c560d0960700ca5469495e1617b36
Instruction ID: e81a39e2c95d7a2aa93b6fb22c7545817c09ae1c5ef17289f2571d190619ca8e
Opcode Fuzzy Hash: 887f4b03423070900513ffa0b71856ebf35c560d0960700ca5469495e1617b36
Instruction Fuzzy Hash: 53631936205B418FCB28CF34D5D066B7BE2BB96314F254A2ED4978B791D739E80ACB05

Function 004E43E0 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 345
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32(?,00000000,?,?), ref: 004E4503
WSASocketW.WS2_32(?,?,?,00000000,00000000,00000081), ref: 004E4580
socket.WS2_32(?,?,?), ref: 004E4599

Strings

|Lr, xrefs: 004E483E
|Lr, xrefs: 004E478A
|Lr, xrefs: 004E47E7

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: Socketgetaddrinfosocket
String ID: |Lr$|Lr$|Lr
API String ID: 2767352139-3361303107
Opcode ID: ac0d3ab10a53c6a9639f18e23422b37821ff75aee6bf04bf1998b068e41de272
Instruction ID: 17de4026a7566b897878abe381382e4c44dc5fe056ce40b67a39742ea35b9a6c
Opcode Fuzzy Hash: ac0d3ab10a53c6a9639f18e23422b37821ff75aee6bf04bf1998b068e41de272
Instruction Fuzzy Hash: ABC1673AA006858FCF14CF65DC807EEB7B5FF94316F14421AD415AB2E1D73A9846DB88

Function 00490750 Relevance: 12.7, APIs: 7, Instructions: 2192COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0049095D
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0049181F
DefWindowProcA.USER32(?,?,?,?,?,?), ref: 0049272C

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$ProcWindow
String ID:
API String ID: 4155614108-0
Opcode ID: ec73c947eec0f816a5e290bca275dc1a9341611e340d81d64e31c4e8c18bfc72
Instruction ID: 50521603a974aa533c5d3c68106470331e880491317c22c70a509ba52b883068
Opcode Fuzzy Hash: ec73c947eec0f816a5e290bca275dc1a9341611e340d81d64e31c4e8c18bfc72
Instruction Fuzzy Hash: FC03D735200B418FCB28CF35D5D0667BBE2BF95350B258A2ED4968BBA1D735E80ACF45

Function 004F23B0 Relevance: 11.4, APIs: 3, Strings: 3, Instructions: 897threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004E2190: std::_Throw_Cpp_error.LIBCPMT ref: 004E22F5

GetCurrentThreadId.KERNEL32 ref: 004F25AE

Strings

UW+, xrefs: 004F2D95
UW+, xrefs: 004F2DD8
TW+, xrefs: 004F2DA0

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: Cpp_errorCurrentThreadThrow_std::_
String ID: TW+$UW+$UW+
API String ID: 350343453-477659226
Opcode ID: 9410cfc3a1351bb350547c9304ddaa9ef7654fef0a0e42ee5ed2aa6580fdbe68
Instruction ID: dc784dcd11343d94a0056f1ac1fcc452a82c6bc0b3316707288f8c19f098865f
Opcode Fuzzy Hash: 9410cfc3a1351bb350547c9304ddaa9ef7654fef0a0e42ee5ed2aa6580fdbe68
Instruction Fuzzy Hash: 8F72F335200B458FCB28CF3896D0677B7E2BF95310B648A1ED99A8B791D774EC0ACB45

Function 00588650 Relevance: 11.4, APIs: 3, Strings: 4, Instructions: 861
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

H=), xrefs: 005889C9
I=), xrefs: 00589001
a73, xrefs: 005890A3
I=), xrefs: 00588D7D

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: H=)$I=)$I=)$a73
API String ID: 0-1616150507
Opcode ID: a9ae86fae0b90c0e43c5e22fd09f6d1144a4c0afee3a5dbe80d2160a84ebc31a
Instruction ID: 8f423be7aacbae321a6c702766ef964176f3a0c8c9562c5ff1477dcc1ee26ccf
Opcode Fuzzy Hash: a9ae86fae0b90c0e43c5e22fd09f6d1144a4c0afee3a5dbe80d2160a84ebc31a
Instruction Fuzzy Hash: 976207393047018FCB28DE3999D0536BBE2FFD93107688A1AD956DB7A0D631EC46DB42

Function 004EA5B0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%>, xrefs: 004EA65D
%>, xrefs: 004EA6A6
%>, xrefs: 004EA87E
%>, xrefs: 004EA86A

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: %>$%>$%>$%>
API String ID: 0-275579199
Opcode ID: 8658111c51faae4bd960a6a1e9bcd752fefc253ff51f453e72ddf05414df2034
Instruction ID: 8e993be0e588d9c61c516e3c64509fa1a63e8a62dd19b5c308432f18f0ae1a49
Opcode Fuzzy Hash: 8658111c51faae4bd960a6a1e9bcd752fefc253ff51f453e72ddf05414df2034
Instruction Fuzzy Hash: 0E610C353046808FCF288E3A99D442777D3AF95315729852BE496CB3A0D629DC9ADF07

Function 004E9070 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 348
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p,, xrefs: 004E94BD
p,, xrefs: 004E928D
@, xrefs: 004E96A5
p,, xrefs: 004E915C

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: @$p,$p,$p,
API String ID: 0-374601288
Opcode ID: 024cfb1704dfad586e034b5bedb665b264f966d6613ec69152ae0168dab174e5
Instruction ID: 2f5566a7a8cb90e118ef0da13b5992cdf959dd5fc877a18108b8446c34539dbe
Opcode Fuzzy Hash: 024cfb1704dfad586e034b5bedb665b264f966d6613ec69152ae0168dab174e5
Instruction Fuzzy Hash: B8C14BB26086C19B8F388E1E94C056F73E19BD4312F69491BE855DB3E1D239CD4AC78B

Function 004F75A0 Relevance: 3.3, APIs: 2, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b96b9fe2e22907d820ff73839e75ccfec3f9dba5edc5a22a430918e44bb3e288
Instruction ID: 06ef30587b858344ffefdb1ca14bd6a0548c5d8ed6844619432d414e45fcecbe
Opcode Fuzzy Hash: b96b9fe2e22907d820ff73839e75ccfec3f9dba5edc5a22a430918e44bb3e288
Instruction Fuzzy Hash: A9B14975A086098BCF289F2895D06BE77E1EF55370F24424BD656AB3E0D33DAC05CB89

Function 004DEEF0 Relevance: 2.7, Strings: 2, Instructions: 234COMMON

Download Yara Rule

Strings

'3%f, xrefs: 004DF00E
'3%f, xrefs: 004DF0C6

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: '3%f$'3%f
API String ID: 0-727188518
Opcode ID: 744748485922757162904f4efeb53aff5cf3894051fff01d65c251785aa6f02a
Instruction ID: b53154c89f9a3261620ed04157a2aad39e532b9a1421869a104f0ab700f7c3ca
Opcode Fuzzy Hash: 744748485922757162904f4efeb53aff5cf3894051fff01d65c251785aa6f02a
Instruction Fuzzy Hash: ED8113757002458FCB188F3898E05AE77E2AF89314B64892BE812DF3A1D639DC0ADB55

Function 005BFB86 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3f2cf81aeef67e162f88b5cfd033076fb3e4bdf912632d000a00060e2210b99
Instruction ID: b6b4f5e58bc5aa9166d41b7c0516feaeca104d2eee67a5561d5cbf26fb758cdb
Opcode Fuzzy Hash: b3f2cf81aeef67e162f88b5cfd033076fb3e4bdf912632d000a00060e2210b99
Instruction Fuzzy Hash: CEF03072611224DBCF16DB48D845A9AB7FCFB45B61F1140A6E541DB151D7B0ED00DBD0

Function 004E4A70 Relevance: 13.7, APIs: 9, Instructions: 215
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ioctlsocket.WS2_32(?,8004667E,00000001), ref: 004E4B02
connect.WS2_32(?,?,00000000), ref: 004E4B13
ioctlsocket.WS2_32(?,8004667E,00000000), ref: 004E4B73
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004E4B97
setsockopt.WS2_32(?,0000FFFF,00001006,00000000,00000004), ref: 004E4BB0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004E4BD0
setsockopt.WS2_32(?,0000FFFF,00001005,00000000,00000004), ref: 004E4BF2

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@ioctlsocketsetsockopt$connect
String ID:
API String ID: 1330999873-0
Opcode ID: f2e714dc7ce25a16c6252951f80f8fded422082b0e3f13992ca49279eb8b4c6b
Instruction ID: 21dc83591d7872edc4730219250d00a07db74fa6c70d3ddec5c740aae4e030d1
Opcode Fuzzy Hash: f2e714dc7ce25a16c6252951f80f8fded422082b0e3f13992ca49279eb8b4c6b
Instruction Fuzzy Hash: FC81D531204280DFCB158F59DC84A2AB7E0ABE5715F198AAAF645CF3A1C739DC05DB4B

Function 005BD3C9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ext-ms-, xrefs: 005BD434
api-ms-, xrefs: 005BD420

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 862a861cd9db26731c67dac2a6eb27b895bedc7fd3f06f80baa6b7838202d753
Instruction ID: c0c1debd5234b4f7d2b03c4c0b93b37984df87ac9a67daa9f6198f8a52f6de50
Opcode Fuzzy Hash: 862a861cd9db26731c67dac2a6eb27b895bedc7fd3f06f80baa6b7838202d753
Instruction Fuzzy Hash: C321D871A02625BBDF314F649C44BAA7F74BB147A4F244522ED46A72A1F6B0FD00D5F0

Function 0058B550 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

WyT, xrefs: 0058B817
WyT, xrefs: 0058B800
WyT, xrefs: 0058B7AC

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: WyT$WyT$WyT
API String ID: 0-1945841279
Opcode ID: 8dc2ea08bfb245029f45d0b4b627954419a4c326fe32a342c023ed03f72b17f0
Instruction ID: 9b724ee8419377718ecdf0bd22cf332171414c57e3b740dbf274e94066ef3d3f
Opcode Fuzzy Hash: 8dc2ea08bfb245029f45d0b4b627954419a4c326fe32a342c023ed03f72b17f0
Instruction Fuzzy Hash: 9B912476A052498FDB149F6898907ED7BFAFFDA320F29061AD851BB2A1D7314C05CB90

Function 004EA330 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

N/!, xrefs: 004EA45C
N/!, xrefs: 004EA3A7
N/!, xrefs: 004EA3AC

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: N/!$N/!$N/!
API String ID: 0-625989065
Opcode ID: c801d6847248ee09bbdb0800fede5a41cc38c618327e9a57f8edd59b16a53316
Instruction ID: 7dadcc76ded4428d6de404503c1d6dc72b50c51c1914fbe5f9434947ee39ae16
Opcode Fuzzy Hash: c801d6847248ee09bbdb0800fede5a41cc38c618327e9a57f8edd59b16a53316
Instruction Fuzzy Hash: 2641BA366087C0EFDF2C456A59E453F21968BE0326F2D811BE91B0F7D0D11AEC6A974B

Function 0047730D Relevance: 6.2, APIs: 4, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0156ddb2abbf75d21cfb16506cb7fe0002200d48451132353ce7dd16787a1f2
Instruction ID: a786d7f72d4160a377d81d07df08738f5d82a64685cca36416365cffa4b38d55
Opcode Fuzzy Hash: c0156ddb2abbf75d21cfb16506cb7fe0002200d48451132353ce7dd16787a1f2
Instruction Fuzzy Hash: 1851CE31B087114BC71DDE389C1226A7BD6ABC5744FA5C53EE84ADB392F6298C0AC7D1

Function 0047747C Relevance: 4.6, APIs: 3, Instructions: 62
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(05265C00,00000000), ref: 00477391
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004773FA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0047743A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0047748D

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$Sleep
String ID:
API String ID: 1587848893-0
Opcode ID: dfadbbf46f274dd91fc6243da409d9567cb1d0c7f3ea42d536a9b56c6f0a358e
Instruction ID: 81086269c62ca8518c5b002e8fd59cd867aa43f895876f27ea52a19930522c08
Opcode Fuzzy Hash: dfadbbf46f274dd91fc6243da409d9567cb1d0c7f3ea42d536a9b56c6f0a358e
Instruction Fuzzy Hash: 15116B32B0470117D71CA93C8C4673D36D6ABD4B04FBA893CF90ADB392FA289C054795

Function 005B1296 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(?,?,Function_001713AE,00000000,00000000,?), ref: 005B12DF
GetLastError.KERNEL32(?,0058B785,00000000,00000000,0058B8C0,?,00000000,?), ref: 005B12EB
__dosmaperr.LIBCMT ref: 005B12F2

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: c6774992e9d66c78c3ccea7b7c8d0240f6d9757f91132de3c1ceaad8e8bfb525
Instruction ID: 6b5a00d70e5284f2990b3b3b48a84d2097d3575156a846340336df1b250ece7b
Opcode Fuzzy Hash: c6774992e9d66c78c3ccea7b7c8d0240f6d9757f91132de3c1ceaad8e8bfb525
Instruction Fuzzy Hash: 3301DE3250060ABFCF149FA1DC19AEE7FA4FF40360F500428F80196150EB30EE10EB94

Function 00477350 Relevance: 3.1, APIs: 2, Instructions: 72
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(05265C00,00000000), ref: 00477391
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004773FA

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: SleepUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4141101911-0
Opcode ID: 317a9b2d6695e94149015236390f7c1cda8445646bae6c3562918e06cab2b6c4
Instruction ID: fa39466428d66511ba34b3efdbab15f3de6d572303e6d46ca2dff3c53432d583
Opcode Fuzzy Hash: 317a9b2d6695e94149015236390f7c1cda8445646bae6c3562918e06cab2b6c4
Instruction Fuzzy Hash: 74116A32B087414787189A3C484113D36D6ABD5724BB9CB3DE92ACB3D1FA298C0A8395

Function 005B13AE Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(005DD880,0000000C), ref: 005B13C1
ExitThread.KERNEL32 ref: 005B13C8

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: af5d72c0d83011d99f36bd3e76789c80783376dcddaa2c7338eec742be59a162
Instruction ID: 334eb20e021b0aff2eea21ff6b79f58c0d4a6ab0a3df794b24f211c5b5651672
Opcode Fuzzy Hash: af5d72c0d83011d99f36bd3e76789c80783376dcddaa2c7338eec742be59a162
Instruction Fuzzy Hash: 69F0C870A00605AFDB14BFB0E80EABD3F75FF84710F20055AF00197252EB346901DBA1

Function 004F3B50 Relevance: 1.7, APIs: 1, Instructions: 152COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004F3D41

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: d62f5c13ef4cff4792b9e76d137e77f1b35e68172a3496dbd09a3704f802cb2c
Instruction ID: e701b485690b7540f86b6dbca4a6fc9e8f890c778b812f024db479ed0f9ff4bf
Opcode Fuzzy Hash: d62f5c13ef4cff4792b9e76d137e77f1b35e68172a3496dbd09a3704f802cb2c
Instruction Fuzzy Hash: 7C5163326002898BCB0CCF6898946BF7BE2EF89315F68456AE1059F3D1D7389E09CB45

Function 005BD490 Relevance: 1.6, APIs: 1, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf56665b2ca9b3a8bbadc3b6a9e97cf1e6352add989ac5c580dfd336eba7e439
Instruction ID: c7c54099968e931b8b487c06be214d5dfe9d423da003b4abd26625a9a5461ddf
Opcode Fuzzy Hash: cf56665b2ca9b3a8bbadc3b6a9e97cf1e6352add989ac5c580dfd336eba7e439
Instruction Fuzzy Hash: 3D01D8337106166F9F2A8F69EC8499A3BF6BBD53607258525F904CB194FE30F805D760

Function 005BC6F1 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,005BE3AA,00000220,AG\,?,?,?,?,?,00000000,00000000,?,005C4741), ref: 005BC723

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a1e83b399c441311a3a70b34078a03def3140c1a3b9c60892dd0120008c63af1
Instruction ID: c4b88e3727474681a9f9dff44e3f65832516fb53d3763c9d51e2e98a271ae95e
Opcode Fuzzy Hash: a1e83b399c441311a3a70b34078a03def3140c1a3b9c60892dd0120008c63af1
Instruction Fuzzy Hash: 56E0653120552566D7212A659C09BDB7E88FF827F1F290129EC46DA190DF50FC0099ED

Non-executed Functions

Function 005014A0 Relevance: 135.4, Strings: 106, Instructions: 2882COMMON

Download Yara Rule

Strings

B$1s, xrefs: 00501A70
C$1s, xrefs: 005023B0
E+V|, xrefs: 00501AAC
%s %s HTTP/1.1, xrefs: 00503A2B
C$1s, xrefs: 00502540
E+V|, xrefs: 00502AC0
PUT, xrefs: 0050268C, 005026C5, 005026D3
C$1s, xrefs: 0050196E
C$1s, xrefs: 005033D9
E+V|, xrefs: 005023B8
Content-Length, xrefs: 00502486, 00502617, 005027A5, 00502E14, 00502E49, 00503088
E+V|, xrefs: 00502583
E+V|, xrefs: 005028EC
E+V|, xrefs: 00502964
Proxy-Authorization, xrefs: 0050287A, 00503685, 005036C2, 005036CE
C$1s, xrefs: 00503380
0.12.1, xrefs: 0050209B
0, xrefs: 0050372C
B$1s, xrefs: 005018D0
E+V|, xrefs: 00501F70
PATCH, xrefs: 005026FF, 00502740, 00502751
C$1s, xrefs: 005037A6
E+V|, xrefs: 00501EF8
E+V|, xrefs: 005025B0
C$1s, xrefs: 0050258D
E+V|, xrefs: 0050238F
C$1s, xrefs: 00502EB0
E+V|, xrefs: 00501B31
cpp-httplib/, xrefs: 0050208A
E+V|, xrefs: 0050376C
C$1s, xrefs: 00502A10
E+V|, xrefs: 00502434
C$1s, xrefs: 00501EF0
C$1s, xrefs: 00503760
E+V|, xrefs: 00503430
C$1s, xrefs: 0050197D
B$1s, xrefs: 00501660
E+V|, xrefs: 00502A93
C$1s, xrefs: 005016FC
Content-Type, xrefs: 005022F0, 00502324, 00502475
C$1s, xrefs: 0050257E
B$1s, xrefs: 00503360
C$1s, xrefs: 00502399
C$1s, xrefs: 00502A6A
C$1s, xrefs: 00501F40
C$1s, xrefs: 00501944
C$1s, xrefs: 00501EC8
C$1s, xrefs: 005023F6
E+V|, xrefs: 0050338C
Host, xrefs: 0050180B, 00501C3B, 00501C73, 00501CB3, 00501CC1, 00501D08, 00501FC9, 00502002
C$1s, xrefs: 0050340D
E+V|, xrefs: 00502A1C
E+V|, xrefs: 00503403
E+V|, xrefs: 00501730
C$1s, xrefs: 005037BA
C$1s, xrefs: 00502A8E
E+V|, xrefs: 005024FC
C$1s, xrefs: 00502F07
C$1s, xrefs: 00501680
B$1s, xrefs: 00503740
C$1s, xrefs: 00502A9D
E+V|, xrefs: 0050199E
C$1s, xrefs: 00502A56
C$1s, xrefs: 00502931
C$1s, xrefs: 0050296E
C$1s, xrefs: 0050238A
E+V|, xrefs: 0050380B
E+V|, xrefs: 005018FC
*/*, xrefs: 00501D69, 00501DA2, 00501DB4
C$1s, xrefs: 005033C5
E+V|, xrefs: 00501973
C$1s, xrefs: 005037DB
POST, xrefs: 00502638, 00502674
text/plain, xrefs: 00502470
E+V|, xrefs: 00502F2D
C$1s, xrefs: 0050240A
E+V|, xrefs: 0050168C
E+V|, xrefs: 00501B5E
C$1s, xrefs: 00502F28
C$1s, xrefs: 00502EF3
B$1s, xrefs: 005024C0
C$1s, xrefs: 005018F0
B$1s, xrefs: 00502E90
E+V|, xrefs: 00502EBC
close, xrefs: 005017BE
E+V|, xrefs: 005037E0
B$1s, xrefs: 005028C0
E+V|, xrefs: 00501ECD
C$1s, xrefs: 00501930
B$1s, xrefs: 00501EA0
C$1s, xrefs: 005028E0
E+V|, xrefs: 00502990
C$1s, xrefs: 00501AF2
B$1s, xrefs: 00502360
C$1s, xrefs: 005033FE
B$1s, xrefs: 005029F0
C$1s, xrefs: 00501AA0
E+V|, xrefs: 00501701
C$1s, xrefs: 0050295F
C$1s, xrefs: 005016D0
C$1s, xrefs: 00501B2C
C$1s, xrefs: 005024F0
E+V|, xrefs: 00502F56
User-Agent, xrefs: 00501DF4, 00501E32, 00501E3E, 005020C5
Connection, xrefs: 0050161D, 005017C3
Accept, xrefs: 00501A34, 00501D6E, 00501DA7, 00501DB9

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: %s %s HTTP/1.1$*/*$0$0.12.1$Accept$B$1s$B$1s$B$1s$B$1s$B$1s$B$1s$B$1s$B$1s$B$1s$B$1s$B$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$C$1s$Connection$Content-Length$Content-Type$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$E+V|$Host$PATCH$POST$PUT$Proxy-Authorization$User-Agent$close$cpp-httplib/$text/plain
API String ID: 0-853620427
Opcode ID: 61397d0b206358d6c77fea409254222b131d5c3983d0e108765419ab279c3918
Instruction ID: 72913c0f0b890421e17212d225a4533b12cd4b6817fea76c44d6c955d02383d1
Opcode Fuzzy Hash: 61397d0b206358d6c77fea409254222b131d5c3983d0e108765419ab279c3918
Instruction Fuzzy Hash: 70336636A006498FCF18CF74A8D56ED7FB6BF95324F284209E451AB2E2D7355E4ACB40

Function 004C04F0 Relevance: 117.5, Strings: 92, Instructions: 2451COMMON

Download Yara Rule

Strings

+W, xrefs: 004C1178
+W, xrefs: 004C1D09
m[, xrefs: 004C13AC
m[, xrefs: 004C1333
+W, xrefs: 004C0C3A
*W, xrefs: 004C12A0
m[, xrefs: 004C18B2
+W, xrefs: 004C0FB8
m[, xrefs: 004C146E
m[, xrefs: 004C185F
+W, xrefs: 004C1C27
*W, xrefs: 004C0890
*W, xrefs: 004C1130
+W, xrefs: 004C0CF3
+W, xrefs: 004C0F92
m[, xrefs: 004C0A26
+W, xrefs: 004C0F6F
m[, xrefs: 004C1B2C
+W, xrefs: 004C1097
+W, xrefs: 004C1559
m[, xrefs: 004C175C
+W, xrefs: 004C0BF8
m[, xrefs: 004C1814
Ea6S, xrefs: 004C06CC
+W, xrefs: 004C0FFB
+W, xrefs: 004C1508
m[, xrefs: 004C1B92
+W, xrefs: 004C1C67
+W, xrefs: 004C1599
m[, xrefs: 004C1732
*W, xrefs: 004C1CC0
m[, xrefs: 004C1850
+W, xrefs: 004C10D9
m[, xrefs: 004C18DE
Fa6S, xrefs: 004C09C1
*W, xrefs: 004C0DF0
+W, xrefs: 004C0E49
*W, xrefs: 004C11D0
+W, xrefs: 004C1280
m[, xrefs: 004C0A9F
+W, xrefs: 004C100A
m[, xrefs: 004C0A54
m[, xrefs: 004C18ED
*W, xrefs: 004C1090
+W, xrefs: 004C0D0F
m[, xrefs: 004C13F0
+W, xrefs: 004C1618
+W, xrefs: 004C0898
*W, xrefs: 004C0BF0
*W, xrefs: 004C1C20
*W, xrefs: 004C0D30
*W, xrefs: 004C0FB0
+W, xrefs: 004C104B
m[, xrefs: 004C1442
+W, xrefs: 004C0D38
+W, xrefs: 004C1138
+W, xrefs: 004C08D8
m[, xrefs: 004C147D
+W, xrefs: 004C1268
+W, xrefs: 004C0BCF
m[, xrefs: 004C0A90
+W, xrefs: 004C14C8
+W, xrefs: 004C0D78
+W, xrefs: 004C1218
+W, xrefs: 004C0C49
m[, xrefs: 004C134F
+W, xrefs: 004C14E0
m[, xrefs: 004C1B02
*W, xrefs: 004C1500
m[, xrefs: 004C1694
+W, xrefs: 004C15D8
+W, xrefs: 004C154A
+W, xrefs: 004C0E3A
+W, xrefs: 004C12E8
m[, xrefs: 004C1BCD
+W, xrefs: 004C0840
m[, xrefs: 004C0B34
m[, xrefs: 004C1382
+W, xrefs: 004C10E8
Fa6S, xrefs: 004C0EB4
+W, xrefs: 004C0DF8
+W, xrefs: 004C12A8
m[, xrefs: 004C0AEE
m[, xrefs: 004C1BBE
m[, xrefs: 004C16D0
+W, xrefs: 004C11D8
*W, xrefs: 004C15D0
+W, xrefs: 004C1CC8
m[, xrefs: 004C16DF
m[, xrefs: 004C0A0E
+W, xrefs: 004C0BB3
m[, xrefs: 004C0B6E

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: *W$*W$*W$*W$*W$*W$*W$*W$*W$*W$*W$*W$*W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$+W$Ea6S$Fa6S$Fa6S$m[$m[$m[$m[$m[$m[$m[$m[$m[$m[$m[$m[$m[$m[$m[$m[$m[$m[$m[$m[$m[$m[$m[$m[$m[$m[$m[$m[$m[$m[$m[$m[
API String ID: 0-4290029852
Opcode ID: 08be6406c49a1cbc1d469e36c2d3eda4b1570a7ef4649ba553b625bf4c749fe9
Instruction ID: e630ff0569d4a9a41f843695fae52d2e429565236dc59dace97babb9ef45a3a3
Opcode Fuzzy Hash: 08be6406c49a1cbc1d469e36c2d3eda4b1570a7ef4649ba553b625bf4c749fe9
Instruction Fuzzy Hash: 7D132A3D7083408FCB588A288590A2FB7D26FC6390F29495FEC9587366D675CC4ADB87

Function 004C7290 Relevance: 30.5, Strings: 24, Instructions: 476COMMON

Download Yara Rule

Strings

uAL6, xrefs: 004C78FB
uAL6, xrefs: 004C769A
uGK, xrefs: 004C7390
uAL6, xrefs: 004C7889
uAL6, xrefs: 004C75BB
uAL6, xrefs: 004C771F
uAL6, xrefs: 004C76C0
tAL6, xrefs: 004C7580
uAL6, xrefs: 004C78EC
uAL6, xrefs: 004C7910
uAL6, xrefs: 004C777A
vGK, xrefs: 004C72D7
uAL6, xrefs: 004C75D0
uAL6, xrefs: 004C75AC
vGK, xrefs: 004C7509
uAL6, xrefs: 004C7635
uAL6, xrefs: 004C7556
tAL6, xrefs: 004C78C0
uAL6, xrefs: 004C77A0
tAL6, xrefs: 004C7670
uAL6, xrefs: 004C78A1
uAL6, xrefs: 004C7737
tAL6, xrefs: 004C7750
uAL6, xrefs: 004C756E

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: tAL6$tAL6$tAL6$tAL6$uAL6$uAL6$uAL6$uAL6$uAL6$uAL6$uAL6$uAL6$uAL6$uAL6$uAL6$uAL6$uAL6$uAL6$uAL6$uAL6$uAL6$uGK$vGK$vGK
API String ID: 0-3317679798
Opcode ID: 53e5e5501d0aa6529fd786d215d89b3204bfb7d16c78ad79eb790d6606b30322
Instruction ID: 209f923b4c3157e461b17ac01733ae37e1328f94ef837bdd9e13ba4e4429c21f
Opcode Fuzzy Hash: 53e5e5501d0aa6529fd786d215d89b3204bfb7d16c78ad79eb790d6606b30322
Instruction Fuzzy Hash: E1F17B3D708240ABCE5C8A2855E4A3F77D35BD0360B28861FE9574B7E4C6398C49DF86

Function 00579500 Relevance: 29.4, Strings: 23, Instructions: 603COMMON

Download Yara Rule

Strings

upjL, xrefs: 00579A98
upjL, xrefs: 00579C4F
G^7C, xrefs: 00579E5D
upjL, xrefs: 00579F34
upjL, xrefs: 0057989D
upjL, xrefs: 00579910
upjL, xrefs: 00579A8E
upjL, xrefs: 00579C2D
gP?, xrefs: 00579944
G^7C, xrefs: 005798B3
upjL, xrefs: 00579C7A
upjL, xrefs: 0057997A
upjL, xrefs: 00579C10
tpjL, xrefs: 005795BC
upjL, xrefs: 00579BFD
upjL, xrefs: 00579C1A
upjL, xrefs: 00579F21
F73, xrefs: 00579821
upjL, xrefs: 00579E6A
upjL, xrefs: 00579EC6
upjL, xrefs: 00579DC8
upjL, xrefs: 00579BD4
gP?, xrefs: 00579A3D

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: F73$G^7C$G^7C$tpjL$upjL$upjL$upjL$upjL$upjL$upjL$upjL$upjL$upjL$upjL$upjL$upjL$upjL$upjL$upjL$upjL$upjL$gP?$gP?
API String ID: 0-3486692178
Opcode ID: 9bf286447b1178689f930e0a9f459c93b0d2a0296f1e82652fa91537f6aa1eed
Instruction ID: 37dbe9500e2d9b63ca87dd4e63db86682980d8fe9629854f01e37bb5dce07aed
Opcode Fuzzy Hash: 9bf286447b1178689f930e0a9f459c93b0d2a0296f1e82652fa91537f6aa1eed
Instruction Fuzzy Hash: 7C221F77E041378B8F299E3CA5D40BD7BB1BE943607668A1ACC5A3B390D6215C41EFE1

Function 004AE3E0 Relevance: 23.4, APIs: 2, Strings: 11, Instructions: 647COMMON

Download Yara Rule

Strings

}~;!, xrefs: 004AEA7D
XrGR, xrefs: 004AE9D3
XrGR, xrefs: 004AE9E8
XrGR, xrefs: 004AE55C
-QD>, xrefs: 004AE4B5
XrGR, xrefs: 004AEA07
XrGR, xrefs: 004AEA18
-QD>, xrefs: 004AE87D
|~;!, xrefs: 004AE400
-QD>, xrefs: 004AE956
}~;!, xrefs: 004AEC22

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: -QD>$-QD>$-QD>$XrGR$XrGR$XrGR$XrGR$XrGR$|~;!$}~;!$}~;!
API String ID: 0-2268063560
Opcode ID: 5056bcc0356452abfce67e74e06423c793dd5640993866aa7de859b6cc09f406
Instruction ID: 040a10f36bf718ec13d65902b351762022f2efa6e5cc5f5c653eecc85cf8441a
Opcode Fuzzy Hash: 5056bcc0356452abfce67e74e06423c793dd5640993866aa7de859b6cc09f406
Instruction Fuzzy Hash: 92322F356083418BCA28872E51D453B36C69BF6324F298E27E476CF3E5D62DCC469B47

Function 004551E0 Relevance: 20.5, Strings: 16, Instructions: 529COMMONLIBRARYCODE

Download Yara Rule

Strings

3"[u, xrefs: 00455616
3"[u, xrefs: 0045567C
3"[u, xrefs: 004556DA
3"[u, xrefs: 00455660
3"[u, xrefs: 0045582E
3"[u, xrefs: 004557BE
3"[u, xrefs: 004556D5
3"[u, xrefs: 00455886
3"[u, xrefs: 00455810
3"[u, xrefs: 0045573C
3"[u, xrefs: 00455611
3"[u, xrefs: 004558D0
3"[u, xrefs: 00455720
3"[u, xrefs: 004557D9
3"[u, xrefs: 004558ED
3"[u, xrefs: 00455881

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: 3"[u$3"[u$3"[u$3"[u$3"[u$3"[u$3"[u$3"[u$3"[u$3"[u$3"[u$3"[u$3"[u$3"[u$3"[u$3"[u
API String ID: 0-2770313315
Opcode ID: eb698c778dd84fe8c00f779d0a473830709594c98a154e31e7e78b18b275c0f6
Instruction ID: e04970d44cd2b4773b3d8cb4019a14aabb59d8eb917e042b53d8f006af7ebe39
Opcode Fuzzy Hash: eb698c778dd84fe8c00f779d0a473830709594c98a154e31e7e78b18b275c0f6
Instruction Fuzzy Hash: 1802AD37E04655CFCF288B6894F02FEB7E29B89362F694057DC556B352CA294C0ECB84

Function 004671D0 Relevance: 20.0, APIs: 2, Strings: 9, Instructions: 772COMMON

Download Yara Rule

Strings

-?7%, xrefs: 00467560
!KT, xrefs: 004678D2
!KT, xrefs: 00467A49
-?7%, xrefs: 004675AE
!KT, xrefs: 00467A5D
O+a, xrefs: 0046762A
-?7%, xrefs: 0046758D
!KT, xrefs: 004675C0
O+a, xrefs: 00467940

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: !KT$!KT$!KT$!KT$-?7%$-?7%$-?7%$O+a$O+a
API String ID: 0-476843299
Opcode ID: f3595077a080ffb199d52c883ba3d79ba10a7c3ee89c6db4690981df19540364
Instruction ID: 50a1275ae688655f6146c2b85e405d088e7a07d3f9dc96bbbaebc6262809132d
Opcode Fuzzy Hash: f3595077a080ffb199d52c883ba3d79ba10a7c3ee89c6db4690981df19540364
Instruction Fuzzy Hash: 6B52E53561C2018FCB28CF28989052EB7E1AFD4358F244A5FF866C73A0E639DD459B87

Function 004FF0F0 Relevance: 16.6, Strings: 13, Instructions: 380COMMON

Download Yara Rule

Strings

^>?, xrefs: 004FF507
^>?, xrefs: 004FF438
^>?, xrefs: 004FF459
^>?, xrefs: 004FF547
^>?, xrefs: 004FF2E8
^>?, xrefs: 004FF5F7
^>?, xrefs: 004FF312
^>?, xrefs: 004FF321
^>?, xrefs: 004FF306
^>?, xrefs: 004FF615
^>?, xrefs: 004FF52B
^>?, xrefs: 004FF62B
^>?, xrefs: 004FF472

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: ^>?$^>?$^>?$^>?$^>?$^>?$^>?$^>?$^>?$^>?$^>?$^>?$^>?
API String ID: 0-36297465
Opcode ID: 73062e5722eb5d14557d0aa888eba1b4529212db09ea628136c9c2b846d76772
Instruction ID: f2c8e4e2eeb61894df6379e8b461a199fa1b5dea80cfe19c9942d36b97be66b6
Opcode Fuzzy Hash: 73062e5722eb5d14557d0aa888eba1b4529212db09ea628136c9c2b846d76772
Instruction Fuzzy Hash: 22D178763083449BCA084A2858A057B7BD25FC5710F2D897FE996CB392D2398C0FD746

Function 00572450 Relevance: 16.1, APIs: 2, Strings: 7, Instructions: 314COMMON

Download Yara Rule

Strings

R^, xrefs: 00572725
R^, xrefs: 005727CE
@Zc, xrefs: 00572490
AZc, xrefs: 005728AD
R^, xrefs: 005726CE
R^, xrefs: 00572827
AZc, xrefs: 005724E0

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: @Zc$AZc$AZc$R^$R^$R^$R^
API String ID: 0-2037085649
Opcode ID: a1e64d62a2ead49fbf8fc82fff530684f4a94de763c656da15cb0aae90508eda
Instruction ID: b67e967fc27d48a02c9b891ba44d05ea4734b7f5a94d19a1d7400e2b5bba8456
Opcode Fuzzy Hash: a1e64d62a2ead49fbf8fc82fff530684f4a94de763c656da15cb0aae90508eda
Instruction Fuzzy Hash: 07B12B363043408B8E1C4A346DD447A7ED3BFD63A0F29C92AE45E8F6E5D521CD89A742

Function 00441000 Relevance: 16.0, Strings: 12, Instructions: 1039COMMON

Download Yara Rule

Strings

QQ, xrefs: 0044109D
QQ, xrefs: 004412F5
~, xrefs: 00441D9D
'juq, xrefs: 004416A4
~, xrefs: 00441D38
QQ, xrefs: 00441F4F
QQ, xrefs: 00441FA4
~, xrefs: 00441D26
hp`, xrefs: 00441300
'juq, xrefs: 004411EA
QQ, xrefs: 00441F90
hp`, xrefs: 00441F18

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: QQ$QQ$QQ$QQ$QQ$'juq$'juq$hp`$hp`$~$~$~
API String ID: 0-3355956011
Opcode ID: 1d2a46206da06820696a6cdacd2c133bbd85d613d70efa1c71bff6b9e74a58c1
Instruction ID: 6593315114f68070c22ac7e8e528bf11d263f7ed4a3ca1101681fd22ec0ee531
Opcode Fuzzy Hash: 1d2a46206da06820696a6cdacd2c133bbd85d613d70efa1c71bff6b9e74a58c1
Instruction Fuzzy Hash: F7821475B05544CFDF18CB68C9D066EB7F2AB88350B24451BE812EB7B0C639DCC29B96

Function 00566550 Relevance: 15.6, Strings: 12, Instructions: 572COMMON

Download Yara Rule

Strings

Ij9, xrefs: 00566A02
@{! , xrefs: 00566A7F
@{! , xrefs: 0056675A
Ij9, xrefs: 00566A32
@{! , xrefs: 005667B0
?{! , xrefs: 00566770
Ij9, xrefs: 00566755
@{! , xrefs: 00566A07
@{! , xrefs: 00566A60
?{! , xrefs: 00566A20
@{! , xrefs: 005667CF
Ij9, xrefs: 00566782

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: ?{! $?{! $@{! $@{! $@{! $@{! $@{! $@{! $Ij9$Ij9$Ij9$Ij9
API String ID: 0-3763162383
Opcode ID: f424bc55e5b2c5ec4781858c9a872a89b8123a570494ea22b6e0dda252d58c92
Instruction ID: a99f730495a7ed4c9f753709257d9438acc92dcde23ac08c3094b97e762240be
Opcode Fuzzy Hash: f424bc55e5b2c5ec4781858c9a872a89b8123a570494ea22b6e0dda252d58c92
Instruction Fuzzy Hash: E9224576B002568BCF14CF7899D01AEBFF2BF99360F298569D855EB391C6318C46CB90

Function 004E64D0 Relevance: 14.1, Strings: 11, Instructions: 392COMMON

Download Yara Rule

Strings

cYhv, xrefs: 004E6650
dYhv, xrefs: 004E6506
wUa, xrefs: 004E6900
vUa, xrefs: 004E68D0
dYhv, xrefs: 004E67E2
wUa, xrefs: 004E6748
wUa, xrefs: 004E6730
wUa, xrefs: 004E691A
wUa, xrefs: 004E68F0
vUa, xrefs: 004E6700
wUa, xrefs: 004E6720

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: cYhv$dYhv$dYhv$vUa$vUa$wUa$wUa$wUa$wUa$wUa$wUa
API String ID: 0-2444858218
Opcode ID: 33851b0e6824ef857f2d2c5c49091a9073896047a9e30012c1162679f4c39a1f
Instruction ID: acaecdfa09fce011f906548289d86a43c0e6ef7faa389d0266385028b4f52b6c
Opcode Fuzzy Hash: 33851b0e6824ef857f2d2c5c49091a9073896047a9e30012c1162679f4c39a1f
Instruction Fuzzy Hash: 3DE13676B002459FCF088F29E8905BEB7F2BFA9351F26451AE806DB3A4D235CC458F95

Function 00514190 Relevance: 14.1, Strings: 11, Instructions: 350COMMON

Download Yara Rule

Strings

/12, xrefs: 005142F0
/12, xrefs: 005143D8
.12, xrefs: 005143A0
/12, xrefs: 005143A7
/12, xrefs: 00514288
&_,, xrefs: 00514339
/12, xrefs: 00514257
/12, xrefs: 00514439
.12, xrefs: 00514250
&_,, xrefs: 005141F6
&_,, xrefs: 00514668

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: .12$.12$/12$/12$/12$/12$/12$/12$&_,$&_,$&_,
API String ID: 0-1866496091
Opcode ID: eed658767549be2f48a1a1cb4aadcc1828964b348bb13f212a8fe165f22084fa
Instruction ID: 942952bf89e78c0d34326818d95131227718fa7d6c1a9a49ad51aa65a0a46640
Opcode Fuzzy Hash: eed658767549be2f48a1a1cb4aadcc1828964b348bb13f212a8fe165f22084fa
Instruction Fuzzy Hash: C1C15E753045814BDB2C8E386CD14BA7BD37FD13647789A29E4B6CB2E5DA20DC8ADB40

Function 00532490 Relevance: 12.9, Strings: 10, Instructions: 401COMMON

Download Yara Rule

Strings

vq2, xrefs: 005327E0
vq2, xrefs: 005326E6
uq2, xrefs: 005326B0
vq2, xrefs: 00532710
vq2, xrefs: 00532700
vq2, xrefs: 005327AB
vq2, xrefs: 005327C3
vq2, xrefs: 005327D0
uq2, xrefs: 00532780
vq2, xrefs: 005326DA

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: uq2$uq2$vq2$vq2$vq2$vq2$vq2$vq2$vq2$vq2
API String ID: 0-3624177132
Opcode ID: b1b79085d977e11138c150739bb31ae93678262994597df55925ceab491be059
Instruction ID: 64fd3673ad1b765d246566bfba8d115e4a294962cde2d80478772482bee434c1
Opcode Fuzzy Hash: b1b79085d977e11138c150739bb31ae93678262994597df55925ceab491be059
Instruction Fuzzy Hash: DDE1E276E046598FCF08CFA4D4906EDBFF6BF98350F29805AD845AB251C734AD46CB90

Function 00517500 Relevance: 12.9, Strings: 10, Instructions: 367COMMON

Download Yara Rule

Strings

?d{f, xrefs: 005178A1
?d{f, xrefs: 00517981
?d{f, xrefs: 00517622
?d{f, xrefs: 00517658
?d{f, xrefs: 00517738
?d{f, xrefs: 00517818
?d{f, xrefs: 005179B8
?d{f, xrefs: 005176FF
?d{f, xrefs: 005177DE
?d{f, xrefs: 005178D8

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: ?d{f$?d{f$?d{f$?d{f$?d{f$?d{f$?d{f$?d{f$?d{f$?d{f
API String ID: 0-4015701808
Opcode ID: 4135b0224a99eb182bc1242aa819c90ef5988b9f8e64db8e95ff78f909b6caf6
Instruction ID: b5cbc137315e08570fa3c1559891dfaa05fe4b91566bb97df1063c3cb145a5ab
Opcode Fuzzy Hash: 4135b0224a99eb182bc1242aa819c90ef5988b9f8e64db8e95ff78f909b6caf6
Instruction Fuzzy Hash: 9EC12D2670C5458BAB144A3C55D45AA3EE37BCD350F38CA6AE4698B2D4D630CC8EDB91

Function 00513300 Relevance: 12.8, Strings: 10, Instructions: 336COMMON

Download Yara Rule

Strings

?d{f, xrefs: 00513727
?d{f, xrefs: 00513558
?d{f, xrefs: 005133C8
?d{f, xrefs: 00513647
?d{f, xrefs: 00513613
?d{f, xrefs: 005134B8
?d{f, xrefs: 0051347F
?d{f, xrefs: 005136F8
?d{f, xrefs: 0051338C
?d{f, xrefs: 0051352B

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: ?d{f$?d{f$?d{f$?d{f$?d{f$?d{f$?d{f$?d{f$?d{f$?d{f
API String ID: 0-4015701808
Opcode ID: 983770a14edbc28fb3ec10c05e2c6b2e9649b1519a851d6b68b74904731247e5
Instruction ID: 91bcc13e870d2888c1f8053af6605aa5b96fa4ba8c7c53a7daf930a1c2104408
Opcode Fuzzy Hash: 983770a14edbc28fb3ec10c05e2c6b2e9649b1519a851d6b68b74904731247e5
Instruction Fuzzy Hash: 62C160727083519F9B148A2C95A059BBFC1BBCE350F598DA9F899D7390D230CE49DB82

Function 0047E310 Relevance: 12.8, APIs: 5, Strings: 3, Instructions: 788COMMON

Download Yara Rule

Strings

8r?<, xrefs: 0047E645
8r?<, xrefs: 0047E439
8r?<, xrefs: 0047E981

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: 8r?<$8r?<$8r?<
API String ID: 0-3874647243
Opcode ID: fec100b1093f449bdde113cfca19ca5cf311e1b1d1bcac66c4fafaa615fc650f
Instruction ID: d5c21c4ced198074f6e2ccf79cb0a6c7d9c5a1d43c5b3363653fb6872170e4ca
Opcode Fuzzy Hash: fec100b1093f449bdde113cfca19ca5cf311e1b1d1bcac66c4fafaa615fc650f
Instruction Fuzzy Hash: 80627E79A00215CFCB18CB69C8D09AEB7F1EB4D314B248A96E816EB3A0C735EC45DF55

Function 0044B420 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 288COMMON

Download Yara Rule

Strings

`a,, xrefs: 0044B46B
`a,, xrefs: 0044B57B
`a,, xrefs: 0044B4C2

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: `a,$`a,$`a,
API String ID: 0-2143604719
Opcode ID: 85fefe3049bc5464aef8ea026dca201e4aa982d052e9263c6ad77f92f8b913e3
Instruction ID: 91457e77fbd086ad2e3f5199a66379cbcbbe7c50df5c8995fd3f5859ed65b934
Opcode Fuzzy Hash: 85fefe3049bc5464aef8ea026dca201e4aa982d052e9263c6ad77f92f8b913e3
Instruction Fuzzy Hash: 3DA14C76B041498F9F188B385CC006E77E2EB94360B288517D821DB3E5D738DC46DBD9

Function 00549470 Relevance: 12.3, APIs: 8, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffe1128e6922ecbe63307ac1fabca064fef09cb970fc0555678404840be02434
Instruction ID: d5a3afdd6b25213d7d56cad8b078c394d5462ce494380bb1a780ebfb16f68729
Opcode Fuzzy Hash: ffe1128e6922ecbe63307ac1fabca064fef09cb970fc0555678404840be02434
Instruction Fuzzy Hash: 3EA144B2A001418FCF188F6898865EFBFF2BF92354B284919D842DB2A5D731DD09DB52

Function 0053B150 Relevance: 11.6, Strings: 9, Instructions: 328COMMON

Download Yara Rule

Strings

2B, xrefs: 0053B494
2B, xrefs: 0053B38C
2B, xrefs: 0053B45F
2B, xrefs: 0053B548
2B, xrefs: 0053B51F
2B, xrefs: 0053B488
2B, xrefs: 0053B554
2B, xrefs: 0053B3B8
2B, xrefs: 0053B3C4

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: 2B$2B$2B$2B$2B$2B$2B$2B$2B
API String ID: 0-1811557806
Opcode ID: 6b6332815ae2671d30e76712dc6fd820f43d160390bc89331170cba9d12ee7b2
Instruction ID: ddf27d98dd1844832a5ab1a5baec860b20911d7d2c6256fc38950867e29cbc41
Opcode Fuzzy Hash: 6b6332815ae2671d30e76712dc6fd820f43d160390bc89331170cba9d12ee7b2
Instruction Fuzzy Hash: 0DC1CA753047448F9728CB38D4D056ABBE2BF99350B248A5ED597CB792C331EC09CB51

Function 005892E0 Relevance: 10.7, Strings: 8, Instructions: 696COMMON

Download Yara Rule

Strings

f{l, xrefs: 00589A02
|=', xrefs: 00589976
|=', xrefs: 005899C0
f{l, xrefs: 005899C8
|=', xrefs: 005899F3
{=', xrefs: 005899A0
|=', xrefs: 005899E4
f{l, xrefs: 005899E9

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: f{l$f{l$f{l${='$|='$|='$|='$|='
API String ID: 0-4098311432
Opcode ID: d11e1740afbfa117d370b4ebfb18bf100ac7aa9901f1e40fd7632481b053168a
Instruction ID: c14fc7bfe121aca04e7430eacd5769daebf0064d6626823cb7813f9c612ec1c0
Opcode Fuzzy Hash: d11e1740afbfa117d370b4ebfb18bf100ac7aa9901f1e40fd7632481b053168a
Instruction Fuzzy Hash: EA321D367083518B8B189E2854D117ABFD2BFC5350F2D9A1EECA6A73A4D635CC09D7C2

Function 00474420 Relevance: 10.7, Strings: 8, Instructions: 662COMMON

Download Yara Rule

Strings

VLD, xrefs: 00474C47
VLD, xrefs: 00474A8E
3v%}, xrefs: 0047458B
3v%}, xrefs: 00474451
VLD, xrefs: 00474B9E
VLD, xrefs: 00474BCB
VLD, xrefs: 00474B29
VLD, xrefs: 00474ABB

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: VLD$ VLD$ VLD$ VLD$ VLD$ VLD$3v%}$3v%}
API String ID: 0-3637346050
Opcode ID: f65c161f7db394aaa53bb3cf8198520b1cf01f3d07573d71e5287103f71c10f5
Instruction ID: ac355defdfe0054c8ea462b359cb41bfb1c8055b8764908c726fc8904fc6b5d9
Opcode Fuzzy Hash: f65c161f7db394aaa53bb3cf8198520b1cf01f3d07573d71e5287103f71c10f5
Instruction Fuzzy Hash: 4232C579308241DFC7198F2894945ABBBD2AFD5350F19C95FE89D873A1C338CD0A9B86

Function 0052F210 Relevance: 10.6, Strings: 8, Instructions: 578COMMON

Download Yara Rule

Strings

wUa, xrefs: 0052F7C0
?umL, xrefs: 0052F2C3
wUa, xrefs: 0052F7EA
wUa, xrefs: 0052F7D0
_d!, xrefs: 0052F360
vUa, xrefs: 0052F7A0
?umL, xrefs: 0052F729
_d!, xrefs: 0052F56B

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: ?umL$?umL$_d!$_d!$vUa$wUa$wUa$wUa
API String ID: 0-3496836322
Opcode ID: 4385056284f311c76952fadbdc122e728ab373938e79c70a420af4fa9e7c3a1a
Instruction ID: 3c4a5aca02ed2c2781244a1cef8596b453c3f9990d15766ac1e1269269b76250
Opcode Fuzzy Hash: 4385056284f311c76952fadbdc122e728ab373938e79c70a420af4fa9e7c3a1a
Instruction Fuzzy Hash: B122B079A00169CFCB18CF68E8D05ADBBF2BF9A720B254539E816DB3E0D6309C45CB51

Function 004FB240 Relevance: 10.3, Strings: 8, Instructions: 305COMMON

Download Yara Rule

Strings

k5^A, xrefs: 004FB63D
KH2<, xrefs: 004FB2D0
JH2<, xrefs: 004FB280
k5^A, xrefs: 004FB2AC
KH2<, xrefs: 004FB612
KH2<, xrefs: 004FB2B6
k5^A, xrefs: 004FB2DB
KH2<, xrefs: 004FB2A7

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: JH2<$KH2<$KH2<$KH2<$KH2<$k5^A$k5^A$k5^A
API String ID: 0-4044113852
Opcode ID: db7417e7891e38d0078f3775fe21b1c3633ffd16d30ccc95eb4d996bb013dd18
Instruction ID: 9eb0c5fdc3a00ff03096553cd343d2ccddb7ad95cad5251b0bb8e63ef6553698
Opcode Fuzzy Hash: db7417e7891e38d0078f3775fe21b1c3633ffd16d30ccc95eb4d996bb013dd18
Instruction Fuzzy Hash: A1A16966B0525D8B8F088A2496D15BF7BD3EFD6210B38811BDE429B399C7388C0BD7C5

Function 005C244F Relevance: 9.2, APIs: 6, Instructions: 193COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005C253F
_free.LIBCMT ref: 005C2690

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: FileFindFirst_free
String ID:
API String ID: 689657435-0
Opcode ID: 225ad07278097111b9f5e77922d5061ea956b12ef17ec1119561b5132aaa0f90
Instruction ID: 818ddf9f546169b5b11543e81e62e2393715d9084935837ccb5bb24f355a7714
Opcode Fuzzy Hash: 225ad07278097111b9f5e77922d5061ea956b12ef17ec1119561b5132aaa0f90
Instruction Fuzzy Hash: 8061D1719011195FDF24AFA8DC89FFABFB8BB45300F1441DEE40997251EA349E849F64

Function 00522200 Relevance: 8.2, Strings: 6, Instructions: 664COMMON

Download Yara Rule

Strings

e"S, xrefs: 00522624
_f43, xrefs: 00522394
e"S, xrefs: 00522305
e"S, xrefs: 005222F1
_f43, xrefs: 005225FF
e"S, xrefs: 00522A7A

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: _f43$_f43$e"S$e"S$e"S$e"S
API String ID: 0-3275933199
Opcode ID: 15bec3155ae73451d5ea86302f0d0a35814efe6b5eb35a1ece53d85e9b5d9198
Instruction ID: c143ac1c6cd24b4f1e55af22474dce9f186e987e30b7b62123f4dc31c4d4175f
Opcode Fuzzy Hash: 15bec3155ae73451d5ea86302f0d0a35814efe6b5eb35a1ece53d85e9b5d9198
Instruction Fuzzy Hash: BC326A7D308665EF8E1CCA38A4F043D7BD2AFA6320F744A5EE4A38B7E0D5258D458742

Function 00563150 Relevance: 8.1, Strings: 6, Instructions: 593COMMON

Download Yara Rule

Strings

cannot use erase() with , xrefs: 0056392D
6dJ, xrefs: 005632E9
6dJ, xrefs: 00563340
iterator out of range, xrefs: 005638E3
iterator does not fit current value, xrefs: 00563897
5dJ, xrefs: 00563320

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: 5dJ$6dJ$6dJ$cannot use erase() with $iterator does not fit current value$iterator out of range
API String ID: 0-2605884498
Opcode ID: 162a7e6aa3f3b52193c06d3d0889185e35e1de77d9c7e0ec926c3202401d3453
Instruction ID: 28070400da7db318b418a4a0c216e15cc431a284112c4dd13c67d347758b0f59
Opcode Fuzzy Hash: 162a7e6aa3f3b52193c06d3d0889185e35e1de77d9c7e0ec926c3202401d3453
Instruction Fuzzy Hash: 03229C7AB002448BCF248B3899D46AD7FE2BFD5360F69855AD8516B3D1DB314F0ACB90

Function 0053A300 Relevance: 7.9, Strings: 6, Instructions: 390COMMON

Download Yara Rule

Strings

]6L, xrefs: 0053A530
]6L, xrefs: 0053A650
]6L, xrefs: 0053A603
]6L, xrefs: 0053A450
]6L, xrefs: 0053A4D0
]6L, xrefs: 0053A3F7

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: ]6L$]6L$]6L$]6L$]6L$]6L
API String ID: 0-3601653423
Opcode ID: 2a3af65a269550209dba4ee14ed065d0e2c08b93fd680953fe5bbbb83d4f1f4f
Instruction ID: 4212678a1c1d88209141c7a3d968c3d988c9b4bafc723c99d52322c6a9a419d1
Opcode Fuzzy Hash: 2a3af65a269550209dba4ee14ed065d0e2c08b93fd680953fe5bbbb83d4f1f4f
Instruction Fuzzy Hash: 08E1E775705B408FCB348F3885D15667BE2BFC5320B298A1AD4E6C7BA1D621EC0ACB52

Function 0053D1A0 Relevance: 7.7, Strings: 6, Instructions: 226COMMON

Download Yara Rule

Strings

|Lr, xrefs: 0053D3BA
|Lr, xrefs: 0053D2E7
|Lr, xrefs: 0053D2BC
|Lr, xrefs: 0053D33A
|Lr, xrefs: 0053D3D7
|Lr, xrefs: 0053D435

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: |Lr$|Lr$|Lr$|Lr$|Lr$|Lr
API String ID: 0-2011822085
Opcode ID: ee13f2ef7510fe1c4037ed1b9861a1afd3289b513cf528e133badcbb74ba27f8
Instruction ID: 7db22588719baa56c53a3ce395839eefcc7942178eab9480e735f6feb73799d7
Opcode Fuzzy Hash: ee13f2ef7510fe1c4037ed1b9861a1afd3289b513cf528e133badcbb74ba27f8
Instruction Fuzzy Hash: 08715E263006414F8B288E3DA9D052B7BF77FD5251B29CE29E892CF3D5DA31EC199750

Function 004E7530 Relevance: 7.3, Strings: 5, Instructions: 1036COMMON

Download Yara Rule

Strings

-g+s, xrefs: 004E834E
-g+s, xrefs: 004E7956
,g+s, xrefs: 004E7770
QU6w, xrefs: 004E8128
QU6w, xrefs: 004E7962

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: ,g+s$-g+s$-g+s$QU6w$QU6w
API String ID: 0-1859280572
Opcode ID: 3ff427e8a50d8ae34bfd9ef981007f44887716d84502850762d034a26e23e944
Instruction ID: af58283589fe182c1c69c3fa075fe52eefce8c90d5f8f5a7a062f6bf617b559d
Opcode Fuzzy Hash: 3ff427e8a50d8ae34bfd9ef981007f44887716d84502850762d034a26e23e944
Instruction Fuzzy Hash: 03822675F04245CFCF18CB29E4905BE7BF2AF89321B28415ED816AB3A0D7359C46CB95

Function 00460210 Relevance: 7.1, Strings: 5, Instructions: 867COMMON

Download Yara Rule

Strings

/G@, xrefs: 004605FE
/G@, xrefs: 0046060E
/G@, xrefs: 004606BC
/G@, xrefs: 00460658
/G@, xrefs: 00460707

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: /G@$/G@$/G@$/G@$/G@
API String ID: 0-4077632988
Opcode ID: 23393c4acabb5d29d7da81f515dad826545044e3e1c8982785331183fa5e3c5a
Instruction ID: fcd1a26919a23b5f88aa234e0b195e9fc2e96656722967ff1bc42a5020feacfb
Opcode Fuzzy Hash: 23393c4acabb5d29d7da81f515dad826545044e3e1c8982785331183fa5e3c5a
Instruction Fuzzy Hash: B0627A36A042548BCF188F78D4D02EF7BF2AF95350F28415BDC529B395E6398D4ACB86

Function 004CE4C0 Relevance: 7.0, Strings: 5, Instructions: 755COMMON

Download Yara Rule

Strings

sWB, xrefs: 004CE794
#Y;, xrefs: 004CE4C0
sWB, xrefs: 004CEB94
sWB, xrefs: 004CEB71
sWB, xrefs: 004CE76E

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: #Y;$sWB$sWB$sWB$sWB
API String ID: 0-4095453692
Opcode ID: df3f1791d5ad5ecac643efd6e62b17e3aa975759c3aaa7e9e6371d471bd9a0e3
Instruction ID: 090536ab922913b9e74355e0d1cc90e8ea4eed355e4802d012d275fd6289f99e
Opcode Fuzzy Hash: df3f1791d5ad5ecac643efd6e62b17e3aa975759c3aaa7e9e6371d471bd9a0e3
Instruction Fuzzy Hash: B652123AA012458FCF18CF69D494BEEB7F2BF85324F29411AD8516B391D739AC4ACB44

Function 00557450 Relevance: 6.6, Strings: 5, Instructions: 383COMMON

Download Yara Rule

Strings

unexpected , xrefs: 0055773E
; expected , xrefs: 005578B7
syntax error , xrefs: 005574DE, 00557517
while parsing , xrefs: 00557538
; last read: ', xrefs: 005577BA

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: ; expected $; last read: '$syntax error $unexpected $while parsing
API String ID: 0-4239264347
Opcode ID: 1359bc972bc5791cbf43fb287eebebc1866679efc52429af6ec7938366d496fe
Instruction ID: ed47748f6a66f81469e92cea933a8d8dccc1e09e4940b1e57f11130f2bd7fe32
Opcode Fuzzy Hash: 1359bc972bc5791cbf43fb287eebebc1866679efc52429af6ec7938366d496fe
Instruction Fuzzy Hash: 47D13576A0421A8FCB18DF68E9A5AAE7FF1FF58350F14412AE8156B3D1D7319D09CB80

Function 00470210 Relevance: 6.5, Strings: 5, Instructions: 201COMMON

Download Yara Rule

Strings

F{V, xrefs: 004704D6
F{V, xrefs: 00470391
F{V, xrefs: 0047028C
F{V, xrefs: 004703A0
F{V, xrefs: 004704C2

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: F{V$F{V$F{V$F{V$F{V
API String ID: 0-785186087
Opcode ID: fd3f09101f400bf210ff292ed058feea82d1e8f6dcd1323a1c634aab3f3385ac
Instruction ID: f1556e5fc2524e6ab7e73b3712a83978d6894cceeff42e18b7b3a5568385c5e5
Opcode Fuzzy Hash: fd3f09101f400bf210ff292ed058feea82d1e8f6dcd1323a1c634aab3f3385ac
Instruction Fuzzy Hash: C5614C37A053B1CBC7144E2458C8682B6D39BC5750F4BC6D7DCA86F26AD23A8C0B87D5

Function 0049B390 Relevance: 6.3, APIs: 4, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63d2441ea3219006a10b43ea870725c5e165af933dfaffd157991baf277d85b8
Instruction ID: adc901b5a23563972e85fc2cbdde8d0bd45d4e20261532710b9ebecce27fd558
Opcode Fuzzy Hash: 63d2441ea3219006a10b43ea870725c5e165af933dfaffd157991baf277d85b8
Instruction Fuzzy Hash: A6913832A0418A9FCF188E68ADD44BE7FB2EF89714B244426E811D7392D3398C15EF65

Function 005C239E Relevance: 6.2, APIs: 4, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005BD75D: HeapAlloc.KERNEL32(00000008,?,00000000,?,005BCA5A,00000001,00000364,00000005,000000FF,?,?,005B365C,005BC6DD,?,?,005B351B), ref: 005BD79E

_free.LIBCMT ref: 005C241F
_free.LIBCMT ref: 005C2436
FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005C253F
_free.LIBCMT ref: 005C260F
FindNextFileW.KERNEL32(00000000,?), ref: 005C261D
_free.LIBCMT ref: 005C266B
FindClose.KERNEL32(00000000), ref: 005C267A
_free.LIBCMT ref: 005C2690

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: _free$Find$File$AllocCloseFirstHeapNext
String ID:
API String ID: 2272182792-0
Opcode ID: 7ae13cd669f3ba2c84dccf404aee98cfe215caad710c1031a8bf99baa5e7ce1a
Instruction ID: b839a49b2928e88a292637374c4a976025783cdada19eaab715f6469fd69f471
Opcode Fuzzy Hash: 7ae13cd669f3ba2c84dccf404aee98cfe215caad710c1031a8bf99baa5e7ce1a
Instruction Fuzzy Hash: 0C513471900219AFDF28AFA89CC9FFE7FA9FF85314F14419DE40997241EA309D429B64

Function 005AC026 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 005AC032
IsDebuggerPresent.KERNEL32 ref: 005AC0FE
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 005AC117
UnhandledExceptionFilter.KERNEL32(?), ref: 005AC121

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: eaca258f3bc76b621feecb490da8d7a19f32003a0723f32db246d68e0c3113f1
Instruction ID: 2b9edba156d8d739120409ac7fd9e17f4279079132c868e915ff1e6b69cde049
Opcode Fuzzy Hash: eaca258f3bc76b621feecb490da8d7a19f32003a0723f32db246d68e0c3113f1
Instruction Fuzzy Hash: 2831F4B5D012199BDF21DFA4D949BCDBBB8BF18304F1041EAE40CAB251EB719A85CF45

Function 005253F0 Relevance: 6.0, Strings: 4, Instructions: 1041COMMON

Download Yara Rule

Strings

cZ:?, xrefs: 005258A9
cZ:?, xrefs: 0052576D
bZ:?, xrefs: 005254C8
cZ:?, xrefs: 005259E6

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: bZ:?$cZ:?$cZ:?$cZ:?
API String ID: 0-1113332767
Opcode ID: 3a3a45dffc5f23906d3077dc1d5e00e7b34ed232ef4675fa90bc7869200822ee
Instruction ID: 296d319d33926d50d30391c968fdf0750c8545b8944560d4f8ea44dd58d08d98
Opcode Fuzzy Hash: 3a3a45dffc5f23906d3077dc1d5e00e7b34ed232ef4675fa90bc7869200822ee
Instruction Fuzzy Hash: AA8228396087518BCF1C8E24A0E057EBBD2BFD6310F694A1EE49B4B3D1E635DC459B82

Function 004FA240 Relevance: 5.8, Strings: 4, Instructions: 816COMMON

Download Yara Rule

Strings

(?:(https?):)?(?://(?:\[([\d:]+)\]|([^:/?#]+))(?::(\d+))?)?([^?#]*)(\?[^#]*)?(?:#.*)?, xrefs: 004FA62D
http, xrefs: 004FA52C
location, xrefs: 004FA2A6
https, xrefs: 004FA527, 004FA97D, 004FAC10

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: (?:(https?):)?(?://(?:\[([\d:]+)\]|([^:/?#]+))(?::(\d+))?)?([^?#]*)(\?[^#]*)?(?:#.*)?$http$https$location
API String ID: 0-4198004140
Opcode ID: cae2b32c7fdaef4bfc06cd7dde2372c6b7a67936a82ed1a604e2dd4b6728b78f
Instruction ID: 1614afc61d2bb40b94e630ed44ebf7d5c2f81d011a071e92e55ca42d23c5e9a0
Opcode Fuzzy Hash: cae2b32c7fdaef4bfc06cd7dde2372c6b7a67936a82ed1a604e2dd4b6728b78f
Instruction Fuzzy Hash: B7620375104B04CBDB28DF34D895BB777E5FB24308F14491EE19A8B2A1EB3AB909CB45

Function 00562170 Relevance: 5.6, Strings: 4, Instructions: 642COMMON

Download Yara Rule

Strings

0^{[, xrefs: 00562540
0^{[, xrefs: 00562376
0^{[, xrefs: 005623C0
0^{[, xrefs: 005624F6

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: 0^{[$0^{[$0^{[$0^{[
API String ID: 0-1191345365
Opcode ID: 13ea91e8fed88900d160694e21a67b4d8c34e7a6a68ca895883818534c681e14
Instruction ID: 3b590d35444bd69cd124edc132d6eaadacf60f744c26232f9d05b4bf2e37a842
Opcode Fuzzy Hash: 13ea91e8fed88900d160694e21a67b4d8c34e7a6a68ca895883818534c681e14
Instruction Fuzzy Hash: EF324636704B418FCB288F34D4946267BE2BF95350F188A5ED89B8BB91D735ED49CB40

Function 0051E300 Relevance: 5.5, APIs: 3, Instructions: 1044COMMON

Download Yara Rule

APIs

std::_Xregex_error.LIBCPMT ref: 0051F0A8
std::_Xregex_error.LIBCPMT ref: 0051F0AF
std::_Xregex_error.LIBCPMT ref: 0051F0BD

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: Xregex_errorstd::_
String ID:
API String ID: 3587890882-0
Opcode ID: 59222ec78486851a31cc1bd9551cb79907890e4f88915f1aa24973004c4fbc09
Instruction ID: 9eb56d8333ade8c2b5974271cd925d45b5a739d9d8d84705a9f5480c1d2e1415
Opcode Fuzzy Hash: 59222ec78486851a31cc1bd9551cb79907890e4f88915f1aa24973004c4fbc09
Instruction Fuzzy Hash: 3382017AA002158FDF14CF68D4C1AEDBBF2BF99320F294659D812AB391D7319D85CB90

Function 00564540 Relevance: 5.5, Strings: 4, Instructions: 474COMMON

Download Yara Rule

Strings

^a, xrefs: 00564620
^a, xrefs: 005645E9
^a, xrefs: 0056490F
^a, xrefs: 00564940

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: ^a$^a$^a$^a
API String ID: 0-2016794178
Opcode ID: 121ba7aa3d44e8dbfcbdd1bf5a872943f9a4d6cb6c0e5a313a0372ac25a780d2
Instruction ID: c56b1758343e6d02fe5e96bbe5f865085889a59d78e8f3c1efe078360276cda3
Opcode Fuzzy Hash: 121ba7aa3d44e8dbfcbdd1bf5a872943f9a4d6cb6c0e5a313a0372ac25a780d2
Instruction Fuzzy Hash: E5022976B00255CFCF188F68E5946AE7BE2BB97360F2A8559D8556B3E1C7318C05CF80

Function 004D0040 Relevance: 5.4, Strings: 4, Instructions: 402COMMON

Download Yara Rule

Strings

wc9], xrefs: 004D00B9
xc9], xrefs: 004D0613
xc9], xrefs: 004D02CB
xc9], xrefs: 004D00C4

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: wc9]$xc9]$xc9]$xc9]
API String ID: 0-1002030405
Opcode ID: 87544f0281c17cf3fb52799354dd475aff1b281fc747986a8c8e2765dd5c63c7
Instruction ID: b7a75dade9f64b46190dd0debdecffa46860c2004611bbc2f26256a75cba1119
Opcode Fuzzy Hash: 87544f0281c17cf3fb52799354dd475aff1b281fc747986a8c8e2765dd5c63c7
Instruction Fuzzy Hash: 6AE14B35709340DB8B188A2898E071E77D26FC5314F64C91BE8D9DB3A5D639CC4ADB47

Function 0053E250 Relevance: 5.4, Strings: 4, Instructions: 374COMMON

Download Yara Rule

Strings

/';, xrefs: 0053E3D0
!/';, xrefs: 0053E48D
!/';, xrefs: 0053E3D7
!/';, xrefs: 0053E476

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: /';$!/';$!/';$!/';
API String ID: 0-2963574719
Opcode ID: 8861f357c825f6f04619b3e3b42fe685a81f1af714fb3e048f09962edf6373cb
Instruction ID: 6ee2d9ab5ded2abe76bec10be91e388a4e6035055b73427672c41bcf952b03ff
Opcode Fuzzy Hash: 8861f357c825f6f04619b3e3b42fe685a81f1af714fb3e048f09962edf6373cb
Instruction Fuzzy Hash: 8CD12D7A709742DB8B288A1895D226E7BD2BFD9350F194C2EF856D73D1D631CC068B82

Function 00509040 Relevance: 5.4, Strings: 4, Instructions: 371COMMON

Download Yara Rule

Strings

*J5I, xrefs: 00509410
i4J, xrefs: 00509103
i4J, xrefs: 00509439
*J5I, xrefs: 005090F8

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: *J5I$*J5I$i4J$i4J
API String ID: 0-611784234
Opcode ID: 2871fa7740326851aa9889fd55ee4ad21aa5d6565bee72e8364d852e865c027b
Instruction ID: dde53e2d5b70fdbf89dc94c1f79247055b2cb7ffb497b244a2063bf2d0f6f6c5
Opcode Fuzzy Hash: 2871fa7740326851aa9889fd55ee4ad21aa5d6565bee72e8364d852e865c027b
Instruction Fuzzy Hash: 70D1BE39B05A058FCF18CE68D8E46AEBBF1BB99320F244655E811EB3E5C231DC45CB51

Function 004FE460 Relevance: 5.4, Strings: 4, Instructions: 368COMMON

Download Yara Rule

Strings

ocN, xrefs: 004FE518
ocN, xrefs: 004FE754
ocN, xrefs: 004FE548
ocN, xrefs: 004FE788

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: ocN$ocN$ocN$ocN
API String ID: 0-1125727286
Opcode ID: bfebffb80567b1cf41d14fa11f0acbf10379ede6dc378cab709ccd37c3280753
Instruction ID: 998cd5f140d481939a33fba2063b8b5d8e678db74980c25d177b11b6cf3d53da
Opcode Fuzzy Hash: bfebffb80567b1cf41d14fa11f0acbf10379ede6dc378cab709ccd37c3280753
Instruction Fuzzy Hash: 37D15C2630C3599B8B188A2A98D043B7AD35FD5391F6C8D5FEE89C73A1D234CD099B46

Function 004A10D0 Relevance: 5.4, Strings: 4, Instructions: 361COMMON

Download Yara Rule

Strings

2" o, xrefs: 004A1334
2" o, xrefs: 004A142F
2" o, xrefs: 004A1228
2" o, xrefs: 004A141B

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: 2" o$2" o$2" o$2" o
API String ID: 0-3435187429
Opcode ID: 80aa254b46ac7daf1106e5c128a4565ab51085aa14b5273fe8f78d90880acf1a
Instruction ID: b377f165a1d33a5dbbc320feb6d476355a8357d6c31c761ef2e5586401e957fe
Opcode Fuzzy Hash: 80aa254b46ac7daf1106e5c128a4565ab51085aa14b5273fe8f78d90880acf1a
Instruction Fuzzy Hash: DDC116797042408FCF1C9E2894E457E76D2AFFA390F29452FD9574B7F1C6288C468B8A

Function 004CA000 Relevance: 5.3, Strings: 4, Instructions: 323COMMON

Download Yara Rule

Strings

%RvG, xrefs: 004CA454
%RvG, xrefs: 004CA249
%RvG, xrefs: 004CA3BE
%RvG, xrefs: 004CA1AE

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: %RvG$%RvG$%RvG$%RvG
API String ID: 0-204049577
Opcode ID: a9e0da41866b4200f2f9125f9ef8e117e91f019728970cbde0eb881b16c7deab
Instruction ID: b16e1a049f0e96ca59a093832e197382d4b8ec02980b16b40eca9ac82d28cda0
Opcode Fuzzy Hash: a9e0da41866b4200f2f9125f9ef8e117e91f019728970cbde0eb881b16c7deab
Instruction Fuzzy Hash: BFB1AE2D7082459FC7184A3458E0A3B7BD35FD5358F28CA1EE89A8B3E1D639CC199B47

Function 0057B1E0 Relevance: 5.2, Strings: 4, Instructions: 199COMMON

Download Yara Rule

Strings

FW%3, xrefs: 0057B230
GW%3, xrefs: 0057B35F
GW%3, xrefs: 0057B250
GW%3, xrefs: 0057B340

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: FW%3$GW%3$GW%3$GW%3
API String ID: 0-2930812216
Opcode ID: 1b0890e91f8cdb76f2aa43bed33a43314f3428e1543ca0bbb0fbcf4d143c65cf
Instruction ID: 37f8c893ebeace14a6d3bf89d72f493732cab0030e594ac564442e108646c4a7
Opcode Fuzzy Hash: 1b0890e91f8cdb76f2aa43bed33a43314f3428e1543ca0bbb0fbcf4d143c65cf
Instruction Fuzzy Hash: 01613B363083449F9A148A38A9C066F7BD37FE5350F29CD19E499CB295D730CD49EB51

Function 0052E080 Relevance: 4.4, Strings: 3, Instructions: 603COMMON

Download Yara Rule

Strings

Content-Encoding, xrefs: 0052E0D1
gzip, xrefs: 0052E114
deflate, xrefs: 0052E159, 0052E198

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: Content-Encoding$deflate$gzip
API String ID: 0-3932100438
Opcode ID: ea5911db5eefbae29c3d7f51170d8fbb89d0d768a9c54769dcb4d25a60319957
Instruction ID: a17a0fbc4e2fd933cdc6f2fede755223b219709a207c630ece8830b3728b6151
Opcode Fuzzy Hash: ea5911db5eefbae29c3d7f51170d8fbb89d0d768a9c54769dcb4d25a60319957
Instruction Fuzzy Hash: C1225A362007518FCB28CF38E8D666A7BD6BFA6364F184E19D4568B6E1D731F849CB40

Function 00456260 Relevance: 4.3, Strings: 3, Instructions: 506COMMONLIBRARYCODE

Download Yara Rule

Strings

]X'T, xrefs: 00456505
]X'T, xrefs: 0045630B
\X'T, xrefs: 00456300

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: \X'T$]X'T$]X'T
API String ID: 0-740687242
Opcode ID: e2bf849e773e493c3b2d9d94eeb8b193f06dc65389d42c30cd5a12b67ee0b964
Instruction ID: 26279f127ffebd5b59b6ec7fc5ffc0396ed1e0841bba1f1cc68f9818291a161f
Opcode Fuzzy Hash: e2bf849e773e493c3b2d9d94eeb8b193f06dc65389d42c30cd5a12b67ee0b964
Instruction Fuzzy Hash: 210226766042419FCB088F2898D092B7BE6AFD5310F598D5EFC85CB3A2D635CC0E9B46

Function 0057E1A0 Relevance: 4.0, Strings: 3, Instructions: 292COMMON

Download Yara Rule

Strings

J<EG, xrefs: 0057E228
AW, xrefs: 0057E5B8
J<EG, xrefs: 0057E1D9

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: AW$J<EG$J<EG
API String ID: 0-2506601726
Opcode ID: e8d261c1cb2bffa29166dc23fb432e40d1c8687714a8df8e5bd66a76e1bc9854
Instruction ID: 38d98c87b48b54e76e1f8c7411539ee6834ec9c8ef16852d60f6966776fe3b1e
Opcode Fuzzy Hash: e8d261c1cb2bffa29166dc23fb432e40d1c8687714a8df8e5bd66a76e1bc9854
Instruction Fuzzy Hash: 2BB10879B003198F8F18CB68E4E18BE7BF6BF5D3547648899E81AE7391C6209C05EF51

Function 00508480 Relevance: 3.3, Strings: 2, Instructions: 818COMMON

Download Yara Rule

Strings

D:P, xrefs: 00508BEC, 00508FAC, 00508FBC, 00508FD1, 00508F26, 00508F36, 00508F4B, 005084BD
%s: %s, xrefs: 00508F62, 00508FE8

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: %s: %s$D:P
API String ID: 0-3986616612
Opcode ID: 159e8d999286a8edc008adfbd0a7c6d987a26011096a1cfe21826ffd323d1efd
Instruction ID: ec8ecc71875d47dd9b1b04cfb69bc84a04ba31641227607370efb77e2b9fcef5
Opcode Fuzzy Hash: 159e8d999286a8edc008adfbd0a7c6d987a26011096a1cfe21826ffd323d1efd
Instruction Fuzzy Hash: EA62E279B016098FCF14CE68C890ABDBBF2BF89310B254555E895EB3E4DA319C468F91

Function 004D34D0 Relevance: 3.2, Strings: 2, Instructions: 686COMMON

Download Yara Rule

Strings

6,Mk, xrefs: 004D3CAE
6,Mk, xrefs: 004D3CE8

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: 6,Mk$6,Mk
API String ID: 0-502606186
Opcode ID: 58891578ff2e3b23c4427fe616a82afa115b5828713ee037ac70471436fc9a42
Instruction ID: 682864aa1b120122de8aa71a1860f8244b9ef579d39dbfe66d059edd9137425c
Opcode Fuzzy Hash: 58891578ff2e3b23c4427fe616a82afa115b5828713ee037ac70471436fc9a42
Instruction Fuzzy Hash: 51423576B043588BCF18CF68D4E06BE7BF2AF89351F28415BD855AB3A0C7299D05CB45

Function 004B31D0 Relevance: 3.2, Strings: 2, Instructions: 681COMMON

Download Yara Rule

Strings

6,Mk, xrefs: 004B3AC8
6,Mk, xrefs: 004B3A6E

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: 6,Mk$6,Mk
API String ID: 0-502606186
Opcode ID: 39fc16dfd5d5be393546fc6d9e2f872cd6277de01b7a0364cb24f773bac4e7a8
Instruction ID: 50d2a7ef88d824300ad508e92c7de06fd78237ccd1068db77189b2573f4a47f2
Opcode Fuzzy Hash: 39fc16dfd5d5be393546fc6d9e2f872cd6277de01b7a0364cb24f773bac4e7a8
Instruction Fuzzy Hash: ED422476B002598BCF18CF69D5D06EE7BF2AF89351F29805AD814AB390C7399D06CF64

Function 004974F0 Relevance: 3.0, Strings: 2, Instructions: 465COMMON

Download Yara Rule

Strings

9y7Y, xrefs: 0049784A
9y7Y, xrefs: 004978EC

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: 9y7Y$9y7Y
API String ID: 0-4046655019
Opcode ID: ba0072c83b2ddda887b34ccf4e3fdbde045b6d173d1467e6f05f246fee31aab6
Instruction ID: d62e2bb8535cd8ab13639f362027c7ea5fb224f8cba70c09c9960f7e20df8272
Opcode Fuzzy Hash: ba0072c83b2ddda887b34ccf4e3fdbde045b6d173d1467e6f05f246fee31aab6
Instruction Fuzzy Hash: D2F1393571C3519BCF1C8A3854E053E7AD2AFD5324F25893FE89A9B390D624DC49CB8A

Function 004A8450 Relevance: 2.4, APIs: 1, Instructions: 899COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bd3a5d9b25a64cb9bb8ae2f5c0dea0293bb27413c9a60e159fa14f5863925e9
Instruction ID: b96cc1ec4ae9303caab3f822520e8b5070ec61758b779a6dc0ea187d0aa8e485
Opcode Fuzzy Hash: 8bd3a5d9b25a64cb9bb8ae2f5c0dea0293bb27413c9a60e159fa14f5863925e9
Instruction Fuzzy Hash: 99626B35B041468B8F28C67885D05BF37A2EBBA364B35451FD422DB3E1EA28DC45CB5A

Function 0046B560 Relevance: 2.1, Strings: 1, Instructions: 844COMMON

Download Yara Rule

Strings

zsh>, xrefs: 0046C16A

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: zsh>
API String ID: 0-523548137
Opcode ID: b62459437e0366733b6140df69aef2503997eb8f4b984ddaf8eb595518e4f0d5
Instruction ID: 8af6dfac118da047f9557562c64567c0ef2dacb54a30c932494d86fbd1c6feef
Opcode Fuzzy Hash: b62459437e0366733b6140df69aef2503997eb8f4b984ddaf8eb595518e4f0d5
Instruction Fuzzy Hash: B962E6753006058FC728CE28C8D096677E2EF953547288A1BD497CB7A4FB35EC86DB86

Function 0055B4E0 Relevance: 1.7, Strings: 1, Instructions: 482COMMON

Download Yara Rule

Strings

excessive object size: , xrefs: 0055BAEE

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: excessive object size:
API String ID: 0-3718820671
Opcode ID: f7ecfe58adf86d6cb5949987cfec58702489b7607049405d627836eeab18fdfa
Instruction ID: ce8cd124136efa62dd548bef1a3dc744cf6f19374faa6bbce426db1b6aa1b9c8
Opcode Fuzzy Hash: f7ecfe58adf86d6cb5949987cfec58702489b7607049405d627836eeab18fdfa
Instruction Fuzzy Hash: 7E025631A013598FCF14CF68D8A59EEBFB5BF94360F28051AE851A7391D7309D49CB90

Function 005BD093 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,005B2D33,?,20001004,00000000,00000002,?,?,005B1C44), ref: 005BD0C7

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: f9b1c065902615ccf1505580ea6ed34357db9355e114c5fa2dd4cc26ce25e63e
Instruction ID: 0d3d41a592c8a3e83cf8834f8dc931fc4a09c7a1f74f6f4d9156fd5a52710a8b
Opcode Fuzzy Hash: f9b1c065902615ccf1505580ea6ed34357db9355e114c5fa2dd4cc26ce25e63e
Instruction Fuzzy Hash: 69E01A3650011CBBCF223F60EC09EEE7E26FB44750F144411FC0966161EB319921AAA5

Function 00587510 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

-tX, xrefs: 005876BA

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: -tX
API String ID: 0-3778505109
Opcode ID: 4b5c91803c79835e3b08fc268d9966abc20cf070a4edd23176aab9ae41a14706
Instruction ID: 7bc88f7d96dfa8094cf1bcf6a6acee0e659c301c735a0dcece4c31e4e9a9e6c5
Opcode Fuzzy Hash: 4b5c91803c79835e3b08fc268d9966abc20cf070a4edd23176aab9ae41a14706
Instruction Fuzzy Hash: A781C136E042599FCF14DF68D9946EEBFF2AF89320F294569D8447B251D7348C05CBA0

Function 005762F0 Relevance: .7, Instructions: 711COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e74a684a124d3be509e873cd3d098279ac95794b73e398b509f4b6f9a0cb856
Instruction ID: deffdf0066da9a79adac0a0a142684e375cb2fff7f4918a347d33eea6fd2f6d6
Opcode Fuzzy Hash: 2e74a684a124d3be509e873cd3d098279ac95794b73e398b509f4b6f9a0cb856
Instruction Fuzzy Hash: 9F42F635204B418FCB288F29E4D056ABFE1BF95350B28C91DD89F8B691D730ED49EB90

Function 005394C0 Relevance: .7, Instructions: 704COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df8413465f38c98931702823659575e210bd697c0b077329ebe75493447d0046
Instruction ID: 6f809081767e043628f4f42fb765a58a8100245cedc56679033953c62e659e7d
Opcode Fuzzy Hash: df8413465f38c98931702823659575e210bd697c0b077329ebe75493447d0046
Instruction Fuzzy Hash: 73526BBAB052098FCB15CF68D8909ADBBF2BF99350F244555E816EB3A0D731EC45CB90

Function 004AC120 Relevance: .6, Instructions: 615COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cf5795c16a09f7b7c42dcd27e98f05cb0c888ebc3a967d7f3e94d408cba176e
Instruction ID: b95c8196256f487e3b864bcf4e6748bfd19d5ba86b31807ad8521126a5b9f209
Opcode Fuzzy Hash: 3cf5795c16a09f7b7c42dcd27e98f05cb0c888ebc3a967d7f3e94d408cba176e
Instruction Fuzzy Hash: EB326A75B05255CF8F58CE68C4E05BE7BF26FBA310B28454AE842E73A1D6288C06DF95

Function 004CD180 Relevance: .6, Instructions: 598COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d68abe7759bb204dd094026ef4b5629c3387170af2cf2c6fe4de7bb915706ec
Instruction ID: d5b6a1387a1f8971b822bdc269c9cddbe0eb5ed65781f6a47c9879cb9615adb0
Opcode Fuzzy Hash: 5d68abe7759bb204dd094026ef4b5629c3387170af2cf2c6fe4de7bb915706ec
Instruction Fuzzy Hash: 53326F79B04248CF8B54CFA8D8809ADBBF2FF8D310B24416AE815EB364D635AC46DF55

Function 004F0420 Relevance: .6, Instructions: 579COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0b3fc3b72575e59ca2773abc42790a09e57628f726251275537226e7df7c1cf
Instruction ID: 9befba4d2edf92c1a15b9ba09a06ed2aa64b7963319a2dfd560a666b47208255
Opcode Fuzzy Hash: a0b3fc3b72575e59ca2773abc42790a09e57628f726251275537226e7df7c1cf
Instruction Fuzzy Hash: A422803AF012198BCF188F3899905FE77D2ABC5360F29866AC9556F392E3345C05DF89

Function 00536410 Relevance: .5, Instructions: 544COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a18c5fdbcbafc58f7f72a19ec720f0943165d0a352acff495a2488cf75bec76b
Instruction ID: d6ef8b9ee1d258db7e2678bf160e5850dca85a1b68b6b0c0f610d2e2a59d5b86
Opcode Fuzzy Hash: a18c5fdbcbafc58f7f72a19ec720f0943165d0a352acff495a2488cf75bec76b
Instruction Fuzzy Hash: D322C37A6083459F8B18CF24C5D045EBBE2BBC9364F15CA2EEC948B391D630DD49DB86

Function 005285C0 Relevance: .5, Instructions: 532COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b4accbeb99a8d576d6e1fd57c3413bb8bdae61239aeb9129241fef2befaf677
Instruction ID: feea650a36af0c58da51317df446fe1586e5adf68293d90b1723f3fa14adaeec
Opcode Fuzzy Hash: 8b4accbeb99a8d576d6e1fd57c3413bb8bdae61239aeb9129241fef2befaf677
Instruction Fuzzy Hash: C312EE719012298FCF08DFA8E894ABEBBF1BF56314F154619E421AB2D1DB35AC49CF50

Function 00575100 Relevance: .5, Instructions: 529COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4e9315e0e24f5a2a852f5e454a7b87a79c1b9d73fa6bf052a1fd0369712634a
Instruction ID: 0bcc721d941813b80e66897e6896dea2885f9f916b74540af4a8fd02ae278e6a
Opcode Fuzzy Hash: c4e9315e0e24f5a2a852f5e454a7b87a79c1b9d73fa6bf052a1fd0369712634a
Instruction Fuzzy Hash: 3F122735204B41CFCB288F34E4E167A7BE2BF95350B58C91DD89F4B6A1E760AD49DB80

Function 00442010 Relevance: .5, Instructions: 488COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ed3286bca58aac52619a7a1a2d7e567bc0fa47b2194e1a7273ebbd3952db5a4
Instruction ID: b8053b2061f6c382a4e28e34dbf6725d3a706a3823149f163e24aa958d48a4f4
Opcode Fuzzy Hash: 7ed3286bca58aac52619a7a1a2d7e567bc0fa47b2194e1a7273ebbd3952db5a4
Instruction Fuzzy Hash: BE02E875B003099F9F18CF68CAD0AAE77F2EF68310BA54116E9119B3A0C7799C45CF56

Function 0052B1F0 Relevance: .5, Instructions: 486COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3c028dfce9a135417eee7b63172e53020a98be5cee9629ce155ab9830ed83f0
Instruction ID: 65f8a13adf94d75cbab29cb539d93fc355b7818cc3665f8fd698510b3117ef47
Opcode Fuzzy Hash: a3c028dfce9a135417eee7b63172e53020a98be5cee9629ce155ab9830ed83f0
Instruction Fuzzy Hash: 29020331A002298FEF18CF24E4A46BE7BF2BF9A354F294619D5026F2D1C7369D45CB94

Function 00537450 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0759e89dfeb027843a55782ef4db998284585271609c4cc89ae55feb0b159d2e
Instruction ID: 2d925d94afc1eff30d76b7d442cbce10c216e82e9507951e9614408ee467df60
Opcode Fuzzy Hash: 0759e89dfeb027843a55782ef4db998284585271609c4cc89ae55feb0b159d2e
Instruction Fuzzy Hash: 4DF16C7AB0C35D9B8E3C4A3454E017E7FD2AFD9360F248A1DD8970B6E5D6318C49DA81

Function 0057D2E0 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d957e4977e137e6f1c30b02142ac85af747c9595f9034266585c1de684208879
Instruction ID: 7a3f83e52863520c6e8126d40a0a9ea7992cb4ca711aedd6a6ac1baf46bd0c17
Opcode Fuzzy Hash: d957e4977e137e6f1c30b02142ac85af747c9595f9034266585c1de684208879
Instruction Fuzzy Hash: 7AF1F476A00255CFCF18CF68E4949AEBBF1FF99360F298159E81AAB390D7315C05DB60

Function 004462F0 Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e1a1fe259decb1b3b4e10760d966a00d950ba77b7c90b3b8ffbce546ad7cd66
Instruction ID: 354898c6506f1d1bfe5c03f34492ee7af0f6f8970720bb9c96a1fd7fb1538027
Opcode Fuzzy Hash: 9e1a1fe259decb1b3b4e10760d966a00d950ba77b7c90b3b8ffbce546ad7cd66
Instruction Fuzzy Hash: 86E16E779152619BAE389F1C45C407F7291A792320F5B465BEC923B3A0CB3D5C868BCB

Function 004DA2F0 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6303af8b27a181a709da0112d5ce342e1ce28d15678a8cecf045209dd8bb028
Instruction ID: e94dbedaf713bed9159e66714efcb1ebb91e4bca9b17aa36d887559ac6ef3c4e
Opcode Fuzzy Hash: b6303af8b27a181a709da0112d5ce342e1ce28d15678a8cecf045209dd8bb028
Instruction Fuzzy Hash: E2E149357082009F8F14CE2885E442F77D2ABD5324F2A890BE895CF351D379DC66AB8B

Function 00542110 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aac1e6fd1aabf6b3c30fcfc4c05825ae0ef3345e8784532296b0c2d921d4e275
Instruction ID: 545ed69bb414495777374ead756f63c6c2baf9ce122d04bf0663aee410d21891
Opcode Fuzzy Hash: aac1e6fd1aabf6b3c30fcfc4c05825ae0ef3345e8784532296b0c2d921d4e275
Instruction Fuzzy Hash: 4ED1DE7AB043658F8F144A6858D06FE7FE2BFDE394FE84616F9509B394D6208D0A8B50

Function 0049E310 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1632634d5d631a993a66a0cc1ac8a893e76d6f303f10e45674f63658f839ec5
Instruction ID: 1ebeb51d5aa766d05f61fd85a6295cb1c9f420d6d46c05dc735aae2b28dd5e84
Opcode Fuzzy Hash: d1632634d5d631a993a66a0cc1ac8a893e76d6f303f10e45674f63658f839ec5
Instruction Fuzzy Hash: 2DE12B35708254CF8F28CE29859042B7BD29BD8764F298E7FE85697394D634CC468F8B

Function 00500110 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6415558378ac7d720e01c009fd370221f24cd82a7fcf7bc677da23d177e54389
Instruction ID: bb6d54e3701ce61219b8b074f3d81fa40686c94165c3812d475ccf1a8504acfe
Opcode Fuzzy Hash: 6415558378ac7d720e01c009fd370221f24cd82a7fcf7bc677da23d177e54389
Instruction Fuzzy Hash: CBD14D7630A341DBCA144A3499C436E7FC37BD5364F29AE1AE8958B2E5C231CC4ADB91

Function 005210E0 Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db8c7877994628af8e2b13974c43cb9fd5ff56e5f0fa1fd0928fe3bc11ab4add
Instruction ID: 3b5888c8a4de1f390d2af84350e23abae013d162cdbea9fea0f54337a57fc29c
Opcode Fuzzy Hash: db8c7877994628af8e2b13974c43cb9fd5ff56e5f0fa1fd0928fe3bc11ab4add
Instruction Fuzzy Hash: 5AD17B76A005658BCF18CB68A8D05FE7FF3BFAA360F244659E416AB2D0D3319D05CB94

Function 00582470 Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f6d805df95891cb0ec748daae51f6ee4160564a080e4c2d0c2ee5c918cd5993
Instruction ID: 175e0fed76c56901a7f90d7471ffb784c1c4787b49c9f0825ee40f69f9c8d93c
Opcode Fuzzy Hash: 1f6d805df95891cb0ec748daae51f6ee4160564a080e4c2d0c2ee5c918cd5993
Instruction Fuzzy Hash: F2D15836B042198F8F148A3889D15AF7FE2BFD5350F298551DC55EB3A9DA30CC4A9BE0

Function 005352A0 Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e95dc8e1e7e549fb69b4339d8b9a68d1597c22be2c2c0a8f650775c7852f913
Instruction ID: e14197c706538db3b7ffb3c2e5838a477c9bd399a2f484de7c5d25a7ef3f4862
Opcode Fuzzy Hash: 6e95dc8e1e7e549fb69b4339d8b9a68d1597c22be2c2c0a8f650775c7852f913
Instruction Fuzzy Hash: 64C16B763096449BCB184E3859D152E3BC36FD5350FA8ED2EE45ACB2A5F231CC09CB92

Function 00526410 Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a0fd116bc8eb3acc55bad037c0611d26a1c37301a91cadbe70099b0018794b2
Instruction ID: d01aa80144d52e7b9a5fa61c568d4625f900f1774a793e44bbc8cca51675f0be
Opcode Fuzzy Hash: 4a0fd116bc8eb3acc55bad037c0611d26a1c37301a91cadbe70099b0018794b2
Instruction Fuzzy Hash: E1D1D679A00555CF8F18CF68E8D09ADBBF1BF8A324B24451AE815DB3E4D630EC45DB91

Function 005850C0 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9a385e3eff26b12f739e8882f23f956147b98ea40c90c277331e47cb66831d6
Instruction ID: a62d17b47f66225cfb16a34169c5f14371321844a69a3aeb9d2f321657f9c5b7
Opcode Fuzzy Hash: d9a385e3eff26b12f739e8882f23f956147b98ea40c90c277331e47cb66831d6
Instruction Fuzzy Hash: 71D1AA36A006548BCF08DF68D4D06AD7FE2BF99360F6D8559DC59BB3A1EA358C05CB80

Function 00469160 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbff0014a638bc8146824cac40d0798a1455e97007a1055aa0a57252c0c06901
Instruction ID: 59e400b30487f6ca2764fd67a1d84e838a84d0d6a5d7c1a6be59056032726d86
Opcode Fuzzy Hash: bbff0014a638bc8146824cac40d0798a1455e97007a1055aa0a57252c0c06901
Instruction Fuzzy Hash: F3D1F5756083469FCB18CF28D89052A77D6BBC5360F254A1EE8A6DB3A0E734DC46CB47

Function 004544E0 Relevance: .3, Instructions: 341COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3df2e6c3f66fd0395aff6cbb84633aa87f54d03319017f96d7e031972e6ec81
Instruction ID: 9d761b0b7b0d7dc7cc2427d6d1441d0bd85bb3970ebc202c2692f17d9d9d76af
Opcode Fuzzy Hash: f3df2e6c3f66fd0395aff6cbb84633aa87f54d03319017f96d7e031972e6ec81
Instruction Fuzzy Hash: 3BC17D7A3042459BCE1C8A2865E447F32D5AFD4315F24451FEC5B8F7E2E628CC8E9B86

Function 004CA4A0 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c718166e412d9fdd3f6ccc95786235717a4e27918cc9cdadce35d601f7d237d2
Instruction ID: 7c44744b2e7039d4724a638a1d3f4a3f05e7216c6b40c2547d5dada70c6fb0b4
Opcode Fuzzy Hash: c718166e412d9fdd3f6ccc95786235717a4e27918cc9cdadce35d601f7d237d2
Instruction Fuzzy Hash: E8D18C79B002099FCB08CF68C8D49AEB7F2AF8E314B14415EE916E73A0D625AC05DF55

Function 0044F280 Relevance: .3, Instructions: 335COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7221535a7027c4c22abbf5c60feb17aed9a9835fc0ff80ffd2dbf74d893562eb
Instruction ID: fff56132ad9574802c8fe2b1d9155c7729307da128083be9f456316907f8ecc0
Opcode Fuzzy Hash: 7221535a7027c4c22abbf5c60feb17aed9a9835fc0ff80ffd2dbf74d893562eb
Instruction Fuzzy Hash: 83C15A363083458BD7148E3895C024B7BD3ABD1320F6ACA7AD8944B399E779DC0F9B85

Function 004523A0 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5029482e39e7b1dc63e523f6c511f02077977e214f852f86ce99695c9e7b1385
Instruction ID: e7b3f97a2ee18d45c0ca99b4ddf08bd6e19839cae8ff4e45b5f2b843331349f2
Opcode Fuzzy Hash: 5029482e39e7b1dc63e523f6c511f02077977e214f852f86ce99695c9e7b1385
Instruction Fuzzy Hash: 47B139393082519B8B1C8A2891E047F7BD2EFDA311B29855FDC970B3D5D6398C4EDB86

Function 00543050 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34867383879c3c43b4131b53c2246ed9192c8890df92cb717038eafe90ed8cd8
Instruction ID: 6d7af003f589ccfdf95e5d0d9409e4676e78bf4c797edd19fe22e6c35ce55c22
Opcode Fuzzy Hash: 34867383879c3c43b4131b53c2246ed9192c8890df92cb717038eafe90ed8cd8
Instruction Fuzzy Hash: 6FB10439B041598F8F18CF68D8E45EEBFF2BF89394B244559D806EB3A0C620DD05DB91

Function 004B5110 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2caf4f65b189f89ad836acf9082f97af6fefae0395595d5fa06a557d3bb03d95
Instruction ID: 432b27a1e105a0293400518c4a52ed3971a9bcfce0363cfe102225f69e710e03
Opcode Fuzzy Hash: 2caf4f65b189f89ad836acf9082f97af6fefae0395595d5fa06a557d3bb03d95
Instruction Fuzzy Hash: 8DA17E353097409B8B0D4A3859E07BFB7D26FC5290FAD895FE89B87391D128CC09DB56

Function 00481200 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f33cc46a547a1d9bda28f44c3849de0f1bd891d4610b027fad91a736a7d5d98
Instruction ID: ea087bc77fd5d371d175a18a79b99404c61336944428d032a63f5f6bb80450c4
Opcode Fuzzy Hash: 0f33cc46a547a1d9bda28f44c3849de0f1bd891d4610b027fad91a736a7d5d98
Instruction Fuzzy Hash: 39B13979705209CF8F08CB6CE5D08BE77F9AB59350B244E5BE416EB3B0C225DC468B5A

Function 004E24A0 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf2f4e6ce2368980e7e29d9a44b752d9ad21475de7a8a14f91d0c38efe334ed2
Instruction ID: e665adb772e43c5d5aaca547e70a61470392d77f03f7695d6d3e0679e8607ee8
Opcode Fuzzy Hash: cf2f4e6ce2368980e7e29d9a44b752d9ad21475de7a8a14f91d0c38efe334ed2
Instruction Fuzzy Hash: 73A18B7A3047818FCB288B399BD052E77D76FC4361F288A1BD4628B3E1D275CC4A9B05

Function 0050D2E0 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 587cffa16357c870b0aab1a5fa3275a4cb57c9bbf70ad39591ec81da89c9624b
Instruction ID: 1c27877a52dbc343ee5e856112d67a7ea44c2fb34eb72fd99195e66248b05042
Opcode Fuzzy Hash: 587cffa16357c870b0aab1a5fa3275a4cb57c9bbf70ad39591ec81da89c9624b
Instruction Fuzzy Hash: 41B1F37AA002058FCF148F68D9806ADBFF2BB89324F198569D8599F3D1D3759C06DF60

Function 004FD510 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15a658fafe7d91339e13e09beb85a994ac5f02b06292f224b4ddce7a1938afaa
Instruction ID: 5eeeaa66f5c01154e8a852db75165212ad886296d629e34e1f6025a6bbf07019
Opcode Fuzzy Hash: 15a658fafe7d91339e13e09beb85a994ac5f02b06292f224b4ddce7a1938afaa
Instruction Fuzzy Hash: D6A1D179B0051A8FCB08CF68D8908BE73F6EF59344B24411AE915DB3A0E739DD0ADB65

Function 00472120 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6043903ad12f6523c52f1376b2d77b83c4989449a5f6d755419326552483fe6
Instruction ID: 348ee84877ef209982e888c80e99d5d154389244b276ec1eaf22b4957c1213d0
Opcode Fuzzy Hash: a6043903ad12f6523c52f1376b2d77b83c4989449a5f6d755419326552483fe6
Instruction Fuzzy Hash: 5FA1486AB041868F8F188B385ED44AE77E2EFC0350738C66AD955DF3A0DB28CD0A9745

Function 0050E1A0 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df0d4ad96095ff15c17865762c1fd0a08ff37eb5c84e27642fbbc77e0c96e4d
Instruction ID: 9d183af0eb066739ca50d3e9109455a57ca8231911eceebba1aa86d99430819a
Opcode Fuzzy Hash: 4df0d4ad96095ff15c17865762c1fd0a08ff37eb5c84e27642fbbc77e0c96e4d
Instruction Fuzzy Hash: 0681F5397052498BCF0C8E2994E25BE7FA7BFC9354B384A1DE8468B3D0D6325C45DB91

Function 004C4250 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a763a790ced771da058ae563eda9e8dde17fdf72b4ffea7810aa5eb9a4d6821
Instruction ID: e46900232b47e4a756356e951723e9e44edbb957ed19771a65f9e35f96908160
Opcode Fuzzy Hash: 2a763a790ced771da058ae563eda9e8dde17fdf72b4ffea7810aa5eb9a4d6821
Instruction Fuzzy Hash: 4281F478B001058F8B58CF68D5E0EAEB3F6AFD9310B24855EE812EB360C635EC45DB59

Function 00546310 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca086030d2d6082f05e629711323dda3a4265bbe48573b523a24ab1b7f03c239
Instruction ID: 4eab7e803cea977100074346d0e26e5420199541e96c95a31243207ee9371647
Opcode Fuzzy Hash: ca086030d2d6082f05e629711323dda3a4265bbe48573b523a24ab1b7f03c239
Instruction Fuzzy Hash: 6F717B363093909F8A08CF3855D02EE7FC6ABD7798F6A8859E8954B285D635CC09C743

Function 0050C340 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 705654d268c9736ff7e68508716e368cd7ce817b3b29cf7d0e49233030e935b2
Instruction ID: 9865de133edae0794a2ced3cc4ff3414a62ecd2d026fad6c366aab8090c2b076
Opcode Fuzzy Hash: 705654d268c9736ff7e68508716e368cd7ce817b3b29cf7d0e49233030e935b2
Instruction Fuzzy Hash: 1A81B17AA002589BCF14CF68D9D46AEBFF1FF4A325F244619E845AB2D0E6315D05CBA0

Function 0049F480 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 243744ee3f17a4929db8c2f4f4b266dbc7016fce1f3bb8011e955df956f595ad
Instruction ID: 316de99a79827bda768fe1ffca44be89a39aa90fbe2706f690e70b9379815d48
Opcode Fuzzy Hash: 243744ee3f17a4929db8c2f4f4b266dbc7016fce1f3bb8011e955df956f595ad
Instruction Fuzzy Hash: 3D617C72B00355DF4F144E6454C04BF7BE7AEDA26072A867BCC65AB395D6384C0F8B94

Function 004BF200 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3f74fee6e4e4c0b5c41dbfee8cd6ac5a39e55e5a7599ee00af383ea214edd1d
Instruction ID: d580e363cc85f989138f9a13e2883a77f97fb185fce8603272cc44c90c5dc161
Opcode Fuzzy Hash: a3f74fee6e4e4c0b5c41dbfee8cd6ac5a39e55e5a7599ee00af383ea214edd1d
Instruction Fuzzy Hash: C071B0357083409FCB048F28998068B7BD2AFD1794F69C95AE8588F399C739DC4E8F95

Function 004581C0 Relevance: 24.8, APIs: 1, Strings: 13, Instructions: 301COMMON

Download Yara Rule

Strings

F5, xrefs: 00458353
F5, xrefs: 00458458
F5, xrefs: 004582D8
F5, xrefs: 00458277
F5, xrefs: 004583A3
F5, xrefs: 00458338
F5, xrefs: 00458388
F5, xrefs: 00458290
(, xrefs: 00458523
F5, xrefs: 004583F6
F5, xrefs: 004582F3
F5, xrefs: 00458445
F5, xrefs: 00458408

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: ($F5$F5$F5$F5$F5$F5$F5$F5$F5$F5$F5$F5
API String ID: 0-3978897721
Opcode ID: 64cdaf932b432f5cd2429f3702a24882add9a36626eec82a2684e28d0460d2da
Instruction ID: c38023c4b18e373aad616e519ada3e70ea0d1b3259ac1ba4d04a66a83ca02a70
Opcode Fuzzy Hash: 64cdaf932b432f5cd2429f3702a24882add9a36626eec82a2684e28d0460d2da
Instruction Fuzzy Hash: 28C1F530614701CFD724CF24C440967BBE2FF69314B254A5EE8C6A7796EF36A849CB45

Function 00459420 Relevance: 23.0, APIs: 1, Strings: 12, Instructions: 277COMMON

Download Yara Rule

Strings

F5, xrefs: 00459603
F5, xrefs: 004596A5
F5, xrefs: 004594D7
F5, xrefs: 00459668
F5, xrefs: 00459538
F5, xrefs: 00459553
F5, xrefs: 004595E8
F5, xrefs: 004595B3
F5, xrefs: 00459656
F5, xrefs: 00459598
F5, xrefs: 004596B8
F5, xrefs: 004594F0

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: F5$F5$F5$F5$F5$F5$F5$F5$F5$F5$F5$F5
API String ID: 0-1018629271
Opcode ID: c22ee64df304f4a56509246d0e2db67755afcfcc9a89cb5919fd25fdace2d5b4
Instruction ID: 1fd9a7eba8007a022fe6db29564b62add1ef11956a9aa95fe75b822ef78e5ad6
Opcode Fuzzy Hash: c22ee64df304f4a56509246d0e2db67755afcfcc9a89cb5919fd25fdace2d5b4
Instruction Fuzzy Hash: A5B1D231614704CFD734CF28C040A67B7E2FFA9305B254A2ED48A87792E735AC5ACB49

Function 0046D2C0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 245COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0046D2F2
std::_Lockit::_Lockit.LIBCPMT ref: 0046D372

Strings

1%tt, xrefs: 0046D335
1%tt, xrefs: 0046D31B
<*^, xrefs: 0046D306

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: LockitLockit::_std::_
String ID: 1%tt$1%tt$<*^
API String ID: 3382485803-2463617466
Opcode ID: e979f5be684243cad6ff1e08121356eb9d2ab05e4218c5f2e3821bcd1f0dfcf6
Instruction ID: d1431506b800613d1aa8b11e4fc5d85133434d1750d974419a5443b5804625d9
Opcode Fuzzy Hash: e979f5be684243cad6ff1e08121356eb9d2ab05e4218c5f2e3821bcd1f0dfcf6
Instruction Fuzzy Hash: 9D912B76F001148FCF18CF69D8906EEB7F5BB58324F19421AD816AB390E7399C46CB86

Function 005C9177 Relevance: 13.8, APIs: 9, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005C9562: CreateFileW.KERNEL32(00000000,00000000,?,005C9220,?,?,00000000,?,005C9220,00000000,0000000C), ref: 005C957F

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005C928B
__dosmaperr.LIBCMT ref: 005C9292
GetFileType.KERNEL32(00000000), ref: 005C929E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005C92A8
__dosmaperr.LIBCMT ref: 005C92B1
CloseHandle.KERNEL32(00000000), ref: 005C92D1
CloseHandle.KERNEL32(00000000), ref: 005C941E
GetLastError.KERNEL32 ref: 005C9450
__dosmaperr.LIBCMT ref: 005C9457

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: 011e68dc62c5b6b2fe2d652ae63fc1726e447ef7fdb13dd7e2811b00c474d3d1
Instruction ID: 866f77ad99e795e3983c6fe2fdfd8a75644283dbcf00875ea83ab7e93a8bbb76
Opcode Fuzzy Hash: 011e68dc62c5b6b2fe2d652ae63fc1726e447ef7fdb13dd7e2811b00c474d3d1
Instruction Fuzzy Hash: F8A11232A041859FCF199FA8DC99BAE3FB5BB46320F18015EE811AF391CB349D06DB51

Function 005C007E Relevance: 13.7, APIs: 9, Instructions: 199COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005C00EC
_free.LIBCMT ref: 005C00F8
_free.LIBCMT ref: 005C0221
_free.LIBCMT ref: 005C022C

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: d0488ec45f15a72ff65fcd3010cb127987b3c602a15f59f5926d81aa1ddf2c9e
Instruction ID: bfb625f91ff50d58f55223faf8995d9be4d53eaa6d967cba16933f8b789ec69a
Opcode Fuzzy Hash: d0488ec45f15a72ff65fcd3010cb127987b3c602a15f59f5926d81aa1ddf2c9e
Instruction Fuzzy Hash: 8C61D076900305DFDB24DFA8C845FAABFE9FB84710F24141DE855AB281EB70A900CB64

Function 005C0370 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005C06D0: _free.LIBCMT ref: 005C06F5

_free.LIBCMT ref: 005C03BE

Part of subcall function 005BC6B7: HeapFree.KERNEL32(00000000,00000000,?,005B351B), ref: 005BC6CD
Part of subcall function 005BC6B7: GetLastError.KERNEL32(?,?,005B351B), ref: 005BC6DF

_free.LIBCMT ref: 005C03C9
_free.LIBCMT ref: 005C03D4
_free.LIBCMT ref: 005C0428
_free.LIBCMT ref: 005C0433
_free.LIBCMT ref: 005C043E
_free.LIBCMT ref: 005C0449

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 10f89baa2e0e33ddf7736a6c1844a4c53b43da7e62d178f93e44d7a4bdad20d8
Instruction ID: 4b6fa2888bff98cc5f7e6f89280bb4a088047caf5629503ebcded20d02659915
Opcode Fuzzy Hash: 10f89baa2e0e33ddf7736a6c1844a4c53b43da7e62d178f93e44d7a4bdad20d8
Instruction Fuzzy Hash: B2116A31550B15EBEA20BFB0CC0BFCB7F9CBFC0700F401819B2D9B6092DA6AB5558665

Function 005AC3AF Relevance: 9.2, APIs: 6, Instructions: 225COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,?,0049B51C,?,?,?,?,?,?,?,25D8D736,?), ref: 005AC43A
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000,?,0049B51C,?,?,?,?,?,?,?,25D8D736), ref: 005AC4C6
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,0049B51C,?,0049B51C,?,?,?,?,?,?,?,25D8D736), ref: 005AC531
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000,?,0049B51C,?,?,?,?,?,?,?,25D8D736), ref: 005AC54D
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?,?,0049B51C,?,?,?,?,?,?,?,25D8D736), ref: 005AC5B0
CompareStringEx.KERNEL32(?,25D8D736,00000000,0049B51C,00000000,?,00000000,00000000,00000000,?,0049B51C,?,?,?,?), ref: 005AC5CD

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: 30943d6ae6b32c7c3c936669855f8a2ff1c2824ada50c28cc531b679437b9dba
Instruction ID: 035f7b1e6ef6cb494bab99add052ac16238b213b8774895b2485710a53d1dbea
Opcode Fuzzy Hash: 30943d6ae6b32c7c3c936669855f8a2ff1c2824ada50c28cc531b679437b9dba
Instruction Fuzzy Hash: 8D71AB72D0021AABDF219FA4C855BFEBFA5BF0E361F140456E844BB191DA25AC448BA4

Function 0049A080 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 240COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0049A0B5
std::_Lockit::~_Lockit.LIBCPMT ref: 0049A0E7
std::_Lockit::~_Lockit.LIBCPMT ref: 0049A3AA

Strings

LD^, xrefs: 0049A0C5

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: Lockitstd::_$Lockit::~_$Lockit::_
String ID: LD^
API String ID: 214967623-2651282244
Opcode ID: f75706c86da2e752e9f7f40c454e882fa926936e2ab3b1cffa4e8cc066cc9c75
Instruction ID: 8c1f8c0abf047e9b82264c6b4c9b54f4d00812929c470c4995486992bc2bc3bf
Opcode Fuzzy Hash: f75706c86da2e752e9f7f40c454e882fa926936e2ab3b1cffa4e8cc066cc9c75
Instruction Fuzzy Hash: 4F91BD75E012448FCF14CF98D895AAE7BB1BB59314F18407AE805EB3A0D339AC55CF96

Function 00471300 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 196COMMON

Download Yara Rule

Strings

Fan, xrefs: 004713A8
Fan, xrefs: 004713B8
Fan, xrefs: 004713E0
Fan, xrefs: 004713D4

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: Fan$Fan$Fan$Fan
API String ID: 0-1485696664
Opcode ID: 69e4d81437f65a4d609d0a7fcc7a9e5b20a3d0c3b05ae739ae5753b7fb9aa647
Instruction ID: 56efc2ef07e320a898b0391fab09de8f32935903f2777a670fd1e11938fd30b8
Opcode Fuzzy Hash: 69e4d81437f65a4d609d0a7fcc7a9e5b20a3d0c3b05ae739ae5753b7fb9aa647
Instruction Fuzzy Hash: 62612D32A002558BCF288F2C95841EE77E5ABD43A4F1AD617D82AAF3B0C7398D458785

Function 0049A3E0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 116COMMON

Download Yara Rule

Strings

R\, xrefs: 0049A3FD
R\, xrefs: 0049A410
R\, xrefs: 0049A422

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: R\$R\$R\
API String ID: 0-2053949808
Opcode ID: fd2192a9088afbe13ba11a9046f5a937124938b29344ea353440d2363231c201
Instruction ID: 7642ff4cecb552dcc2e8eae4f03b25e84379ebf6065cec817c6289efff8ad1b9
Opcode Fuzzy Hash: fd2192a9088afbe13ba11a9046f5a937124938b29344ea353440d2363231c201
Instruction Fuzzy Hash: C64196357082108FCF188A28989852B7BE1ABD8314F22493BD45ACB365C779DC55DBD7

Function 005B1545 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,005B15CF,?,?,005B1650,?,?,?), ref: 005B155A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 005B156D
FreeLibrary.KERNEL32(00000000,?,?,005B15CF,?,?,005B1650,?,?,?), ref: 005B1590

Strings

CorExitProcess, xrefs: 005B1565
mscoree.dll, xrefs: 005B1553

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 79c2e68c6e0f235bda51dcdee9b7b0a18bc44a5da70a299be5c005d0021b5791
Instruction ID: 901dd12120f7f30bd48d17cf2d28d37647b696f5b974552927ee5e8246bd7ed0
Opcode Fuzzy Hash: 79c2e68c6e0f235bda51dcdee9b7b0a18bc44a5da70a299be5c005d0021b5791
Instruction Fuzzy Hash: 67F08C30901618FBCB31AB54EC0ABED7F68FF40796F000166E406A21A0DF709F04EE90

Function 005C028C Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 005C02A4

Part of subcall function 005BC6B7: HeapFree.KERNEL32(00000000,00000000,?,005B351B), ref: 005BC6CD
Part of subcall function 005BC6B7: GetLastError.KERNEL32(?,?,005B351B), ref: 005BC6DF

_free.LIBCMT ref: 005C02B6
_free.LIBCMT ref: 005C02C8
_free.LIBCMT ref: 005C02DA
_free.LIBCMT ref: 005C02EC

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 263993343adcb2012775097258e2081e1f1ac26ed28bea0f2c7943f48d5c56d0
Instruction ID: 62f6ac6630ba32a45d5ed00e5aa51d7fdad7b511d627212f3151f909075e494b
Opcode Fuzzy Hash: 263993343adcb2012775097258e2081e1f1ac26ed28bea0f2c7943f48d5c56d0
Instruction Fuzzy Hash: EEF0C832100650EF8618EF98E4CFD5A7FD9BA587507642C0DF494DB945CB31FC84866C

Function 0046E010 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0046E046
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0046E0C5

Part of subcall function 005AAC3C: _Yarn.LIBCPMT ref: 005AAC5B
Part of subcall function 005AAC3C: _Yarn.LIBCPMT ref: 005AAC7F

std::_Lockit::~_Lockit.LIBCPMT ref: 0046E16A

Strings

bad locale name, xrefs: 0046E11F

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: std::_$LockitYarn$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 3683006843-1405518554
Opcode ID: adf77c33aefebc27585a562a5ca1ef30ce85ff72cc790aabca8bc9c11df5c95d
Instruction ID: bf4aca162964ecfd340632ebaa723197c9b7b2a89b93767f7eba76d5b2a2db78
Opcode Fuzzy Hash: adf77c33aefebc27585a562a5ca1ef30ce85ff72cc790aabca8bc9c11df5c95d
Instruction Fuzzy Hash: 9741AEB480064A9FC700DF65D8957DEBBF4FF49314F04412AD408A7781EB79A958CBE6

Function 005C70CF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,005C716B,?,FFAB860D,00000000,?,?,?,005C7029,00000002,FlsGetValue,005D12F4,005D12FC), ref: 005C70DC
GetLastError.KERNEL32(?,005C716B,?,FFAB860D,00000000,?,?,?,005C7029,00000002,FlsGetValue,005D12F4,005D12FC,?,?,005BAE8E), ref: 005C70E6
LoadLibraryExW.KERNEL32(?,00000000,00000000,FFAB860D,?,FFAB860D), ref: 005C710E

Strings

api-ms-, xrefs: 005C70F3

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 1f8d316aa95d279011761201bc31ccdd887ac38f95b62bbe10c132d03dbf5e1c
Instruction ID: 44b2a1e30b2001165bc34bbb17765b863a1280e2aab4372d6040961214da20fa
Opcode Fuzzy Hash: 1f8d316aa95d279011761201bc31ccdd887ac38f95b62bbe10c132d03dbf5e1c
Instruction Fuzzy Hash: 44E01230644209BBEF301FA1EC06F683F64BB14B90F144436F90DA84E2EB729854DA89

Function 005BF51E Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 005BF5A8

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: be3a482cfb83731e2a1fd3e52bd0227d612d87cde221266f45b814d0dd62b475
Instruction ID: ee70ef46518e378efe3d524fceaa5803cf5363f09c720812f85fd6ed2af2f4d4
Opcode Fuzzy Hash: be3a482cfb83731e2a1fd3e52bd0227d612d87cde221266f45b814d0dd62b475
Instruction Fuzzy Hash: 0AB1F5729002469FDB158F68CC81BFEBFE5FF55340F2445BAE8559B242D634AE41CB60

Function 005BC050 Relevance: 6.3, APIs: 4, Instructions: 275COMMON

Download Yara Rule

APIs

__FindPESection.LIBCMT ref: 005BC181
VirtualQuery.KERNEL32(83000000,BA6DB144,0000001C,BA6DB144,?,?,?), ref: 005BC266
__FindPESection.LIBCMT ref: 005BC2A3
__FindPESection.LIBCMT ref: 005BC2DD

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: FindSection$QueryVirtual
String ID:
API String ID: 2992484814-0
Opcode ID: d79fdd31a62166ae62e80de5272f80315216b508f7dfd0827469698a4de913f1
Instruction ID: 0888d019e6cebbcc796b3e3c5dd98f4de6d0da43eb831728cd735ad5f11f3582
Opcode Fuzzy Hash: d79fdd31a62166ae62e80de5272f80315216b508f7dfd0827469698a4de913f1
Instruction Fuzzy Hash: 14A1AB75A0021A9FDF24CF98D8806EEBFA4FB58311F104529D859EB261E731FC05CBA8

Function 005C2012 Relevance: 6.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 005C20A7
_free.LIBCMT ref: 005C21F3

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: _free_strpbrk
String ID:
API String ID: 3300345361-0
Opcode ID: cfe42419a48b674bd03234050fdc44e8573882f451da2906b53a9d63a30c947e
Instruction ID: 795925bb72724b30d457cfefadadc4faa3dbdea07a96835726321e8da7b10f27
Opcode Fuzzy Hash: cfe42419a48b674bd03234050fdc44e8573882f451da2906b53a9d63a30c947e
Instruction Fuzzy Hash: B8611A75D00219AFCB14DFA9C885AEDBBF5FF88310F28816AE915B7300D675AE41CB90

Function 005BB45B Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 005BB522
___AdjustPointer.LIBCMT ref: 005BB545
___AdjustPointer.LIBCMT ref: 005BB5E1

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 2f1f3c43d8d70b321cf38b19ce2f73d5cd4bff8143e2d8f0737fa7b7c35a8ece
Instruction ID: fc0e509f749082964e4d9f01a70a22dd0bb64c0df2a9877fdc9ef79e16954799
Opcode Fuzzy Hash: 2f1f3c43d8d70b321cf38b19ce2f73d5cd4bff8143e2d8f0737fa7b7c35a8ece
Instruction Fuzzy Hash: 5351BBB2A006069FEB389F54D885BFA7BA5FF84310F144429E846866E1E7F1FD40DB91

Function 005CA111 Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 005CA1E1
_free.LIBCMT ref: 005CA20A
SetEndOfFile.KERNEL32(00000000,005C97F7,00000000,005C3E65,?,?,?,?,?,?,?,005C97F7,005C3E65,00000000), ref: 005CA23C
GetLastError.KERNEL32(?,?,?,?,?,?,?,005C97F7,005C3E65,00000000,?,?,?,?,00000000,?), ref: 005CA258

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: df5332bb32cb7e121b5bd5c0968464454e31016e727f90a0c1170197481b10c4
Instruction ID: 10158e407fbef6bc84ecb76f96a05a7244b38c2f1c5fd05efef3c578ac0d0b97
Opcode Fuzzy Hash: df5332bb32cb7e121b5bd5c0968464454e31016e727f90a0c1170197481b10c4
Instruction Fuzzy Hash: 0641A37A90060AAEDB156BE8CC0AF9E7F65BF84364F180519F524E6292DB31DD40C762

Function 0056A110 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0056A190
___std_exception_destroy.LIBVCRUNTIME ref: 0056A19F

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: ___std_exception_destroy
String ID:
API String ID: 4194217158-0
Opcode ID: 551f664216c5d05cb212ac9b41fc73a7885f7e9a0b2bb53dff4749b33943ebc3
Instruction ID: 5ccac775c8e75e1c5762521247c03979c9270c3c6112f037c011793b80a38b0c
Opcode Fuzzy Hash: 551f664216c5d05cb212ac9b41fc73a7885f7e9a0b2bb53dff4749b33943ebc3
Instruction Fuzzy Hash: 15315EBA6002414FDE248F64AC8545EBEE1BED33607384E19D896DB291D732ED0DDA93

Function 005C2248 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 005AF67B: _free.LIBCMT ref: 005AF689

Part of subcall function 005BC7BB: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,005BDD41,?,00000000,00000000), ref: 005BC867

GetLastError.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00000000,?,00000000), ref: 005C22B0
__dosmaperr.LIBCMT ref: 005C22B7
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 005C22F6
__dosmaperr.LIBCMT ref: 005C22FD

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 4968c8c81fbe9e4d38e33c10b050193e183a0ef5491a86c8bd54a8521c3cd47e
Instruction ID: 51651cfce50a6505f4baf7fda0d67202c2be3ce42523a5b52998624b5a28871c
Opcode Fuzzy Hash: 4968c8c81fbe9e4d38e33c10b050193e183a0ef5491a86c8bd54a8521c3cd47e
Instruction Fuzzy Hash: 4521A771500216BFDB20AFA2CC84E6A7F6CFF50364B50891DF82997151D734ED40DBA0

Function 005CA2ED Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,005C9AE5,00000000,00000001,00000000,00000000,?,005C51D7,?,6C4A0860,00000000), ref: 005CA304
GetLastError.KERNEL32(?,005C9AE5,00000000,00000001,00000000,00000000,?,005C51D7,?,6C4A0860,00000000,?,00000000,?,005C4C6B,00000000), ref: 005CA310

Part of subcall function 005CA361: CloseHandle.KERNEL32(FFFFFFFE,005CA320,?,005C9AE5,00000000,00000001,00000000,00000000,?,005C51D7,?,6C4A0860,00000000,?,00000000), ref: 005CA371

___initconout.LIBCMT ref: 005CA320

Part of subcall function 005CA342: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,005CA2DE,005C9AD2,00000000,?,005C51D7,?,6C4A0860,00000000,?), ref: 005CA355

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,?,005C9AE5,00000000,00000001,00000000,00000000,?,005C51D7,?,6C4A0860,00000000,?), ref: 005CA335

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 6f673a280947616f1511ca54791988bb06138f34f7076fa1d5b4c791f649c2e4
Instruction ID: 8faa180b8790bcb1c0ad83d4910fb24b5ad1717ba2c8addd53e7a76c9b784685
Opcode Fuzzy Hash: 6f673a280947616f1511ca54791988bb06138f34f7076fa1d5b4c791f649c2e4
Instruction Fuzzy Hash: 71F01C36401559FFCF221FE5DC08E9D3F66FB697A0B044516FA0995120CA32CC20EB91

Function 00505380 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 154COMMON

Download Yara Rule

Strings

g`OT, xrefs: 00505480
g`OT, xrefs: 00505428

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: g`OT$g`OT
API String ID: 0-3929824368
Opcode ID: 45eb4ea32edde8ad7bfefd31c81342ef04ba232b55b4df9b1b7e479af037452e
Instruction ID: 87e1d237204b39849c15518a1e9986bd095e9ab63eb5739e4fe6c7b5527025a9
Opcode Fuzzy Hash: 45eb4ea32edde8ad7bfefd31c81342ef04ba232b55b4df9b1b7e479af037452e
Instruction Fuzzy Hash: 7B51077AE016198BCF14CF6C88C45EEBBE2BB89365B560165DC24E7391E6349C898F90

Function 004AB060 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

std::_Xregex_error.LIBCPMT ref: 004AB1BA

Strings

P6?, xrefs: 004AB0AE
P6?, xrefs: 004AB108

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: Xregex_errorstd::_
String ID: P6?$P6?
API String ID: 3587890882-3910330062
Opcode ID: dae0873950305a3233c43545d888481af2eb96707e20cf607b15196989765148
Instruction ID: 255b08e47282da3d91ef3a4427c3a2e56c8803e2d62da20620c5ed0221ad6f74
Opcode Fuzzy Hash: dae0873950305a3233c43545d888481af2eb96707e20cf607b15196989765148
Instruction Fuzzy Hash: 9E31A036748211DFCB18462895A6767B3C2D7F6360F25C42BD89887396E3398C04DACA

Function 005BE36D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 005BE1F7: GetOEMCP.KERNEL32(00000000,005BE388,005C4741,00000000,00000000,00000000,00000000,?,005C4741), ref: 005BE222

_free.LIBCMT ref: 005BE3E5

Strings

AG\, xrefs: 005BE2DE, 005BE39F

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: _free
String ID: AG\
API String ID: 269201875-1409088248
Opcode ID: d4b365817d9d9559a4b1653f7d5436cca03809d248f020deccf1a61755d31b7a
Instruction ID: dbab22924e59f156fd01c9952139dc964c383a6bfdf63da39eb219c196d3bf22
Opcode Fuzzy Hash: d4b365817d9d9559a4b1653f7d5436cca03809d248f020deccf1a61755d31b7a
Instruction Fuzzy Hash: 96317E7190024AAFCB01DF58C886ADE7FE5FF84314F19446AF9119B2A1EB32AD50CB61

Function 005BB3C4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 005BB63B

Strings

csm, xrefs: 005BB65D
csm, xrefs: 005BB6CE

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 7b5975251f2821ea003e078193f7f6a1255c0f6af47c42e97ac5572079383e78
Instruction ID: 047b14d81d203928f917c6e08aa0d11a3b843c6cd5191f8ec891cdef57f7e1a4
Opcode Fuzzy Hash: 7b5975251f2821ea003e078193f7f6a1255c0f6af47c42e97ac5572079383e78
Instruction Fuzzy Hash: 7A31E132400209DFEF269F60C8499FA7F66FF59354B18465AFC540A222CBF2EC61DB91

Function 005C02F5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005C033C

Strings

0F], xrefs: 005C030A

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID: _free
String ID: 0F]
API String ID: 269201875-1758722376
Opcode ID: 06a474b25e9329ec41c71a0502bddc52c3f595b1cf3d1a8eb1cf4f148915ad35
Instruction ID: 2d8a234ce900556241b6e7afa294e9c4939636bda08da26dae82977b5d09ebf5
Opcode Fuzzy Hash: 06a474b25e9329ec41c71a0502bddc52c3f595b1cf3d1a8eb1cf4f148915ad35
Instruction Fuzzy Hash: BFF0F433408251EFE7146AA5AC46FEB3F98FBC1B70F24182EF90C4E1C2DA61180142B5

Function 005BE1F7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetOEMCP.KERNEL32(00000000,005BE388,005C4741,00000000,00000000,00000000,00000000,?,005C4741), ref: 005BE222
GetACP.KERNEL32(00000000,005BE388,005C4741,00000000,00000000,00000000,00000000,?,005C4741), ref: 005BE239

Strings

AG\, xrefs: 005BE246

Memory Dump Source

Source File: 0000000D.00000002.3429452876.0000000000441000.00000020.00000001.01000000.00000006.sdmp, Offset: 00440000, based on PE: true

Associated: 0000000D.00000002.3429428813.0000000000440000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429632088.00000000005CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429672662.00000000005DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429694966.00000000005EB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000D.00000002.3429737112.00000000005EF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_440000_anterra.jbxd

Similarity

API ID:
String ID: AG\
API String ID: 0-1409088248
Opcode ID: 6eb543ec4e191ab7933d0e56a3426093978b17e7349efb51a0b19dcbe684f0f4
Instruction ID: baffeb735056f66f9b4bed937cb29b30f22e2bf90be37e125e501741cedce88b
Opcode Fuzzy Hash: 6eb543ec4e191ab7933d0e56a3426093978b17e7349efb51a0b19dcbe684f0f4
Instruction Fuzzy Hash: 5CF0C230404104DBEB24DBA8E94A7E9BBB5BB55339F180B44E0358A1E1DB70A84ADB40

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Process: Process Creation, Service: Service Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2Wr5r2e9vo.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files.cab

C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\4244ba815cc94a57841dfebadb3b6b17$dpx$.tmp\8cccbf84c3e089418139dd95981f2766.tmp

C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\files\anterra.exe (copy)

C:\Users\user\AppData\Local\Temp\MW-f76490c4-b905-436a-bbaf-3329bc84ae5f\msiwrapper.ini

C:\Windows\Installer\3a9a03.msi

C:\Windows\Installer\MSI9DBC.tmp

C:\Windows\Installer\SourceHash{D425ECE9-AA22-4FB8-9E95-B5A59C391C55}

C:\Windows\Installer\inprogressinstallinfo.ipi

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

C:\Windows\Temp\~DFCF734CD0CE30AA3D.TMP

C:\Windows\Temp\~DFDBE736A01738D6FA.TMP

\Device\ConDrv

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Windows Analysis Report
2Wr5r2e9vo.msi

Function 004E43E0 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 345
networkCOMMON

Function 00588650 Relevance: 11.4, APIs: 3, Strings: 4, Instructions: 861
COMMON

Function 004EA5B0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 202
COMMON

Function 004E9070 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 348
COMMON

Function 004F75A0 Relevance: 3.3, APIs: 2, Instructions: 310
COMMON

Function 004E4A70 Relevance: 13.7, APIs: 9, Instructions: 215
networkCOMMON

Function 005BD3C9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMONLIBRARYCODE

Function 0058B550 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 248
COMMON

Function 004EA330 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 153
COMMON

Function 0047730D Relevance: 6.2, APIs: 4, Instructions: 160
COMMON

Function 0047747C Relevance: 4.6, APIs: 3, Instructions: 62
sleepCOMMON

Function 005B1296 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 00477350 Relevance: 3.1, APIs: 2, Instructions: 72
sleepCOMMON