Edit tour

Windows Analysis Report
unique.exe

Overview

General Information

Sample name:	unique.exe
Analysis ID:	1565322
MD5:	814a59368670f8d35ad8eb71ab874666
SHA1:	ca386125774e35b84c16bacfbe52919a354434ac
SHA256:	98d8aa77d46e09b79c04b5f4556b1d389c6f62549a5ac0f961a6d8f2961fa55d
Tags:	exeuser-aachum
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Suricata IDS alerts with low severity for network traffic

Terminates after testing mutex exists (may check infected machine status)

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

unique.exe (PID: 7344 cmdline: "C:\Users\user\Desktop\unique.exe" MD5: 814A59368670F8D35AD8EB71AB874666)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "45.130.145.152", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite", "build_name": "Work", "links": "", "port": 15666}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1491224091.000001EF1F070000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: unique.exe PID: 7344	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: unique.exe PID: 7344	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.unique.exe.1ef1f1a0000.0.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.unique.exe.1ef1f1a0000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T16:07:06.069806+0100	2049441	1	A Network Trojan was detected	192.168.2.7	49699	45.130.145.152	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T16:07:06.069806+0100	2050806	1	A Network Trojan was detected	192.168.2.7	49699	45.130.145.152	15666	TCP
2024-11-29T16:07:06.190295+0100	2050806	1	A Network Trojan was detected	192.168.2.7	49699	45.130.145.152	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T16:07:06.069806+0100	2050807	1	A Network Trojan was detected	192.168.2.7	49699	45.130.145.152	15666	TCP
2024-11-29T16:07:06.190295+0100	2050807	1	A Network Trojan was detected	192.168.2.7	49699	45.130.145.152	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.unique.exe.1ef1f1a0000.0.raw.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "45.130.145.152", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite", "build_name": "Work", "links": "", "port": 15666}

Multi AV Scanner detection for submitted file

Source: unique.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F211EA0 CryptUnprotectData,LocalFree,	0_2_000001EF1F211EA0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F2121C0 CryptProtectData,LocalFree,	0_2_000001EF1F2121C0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1D5EE0 CryptUnprotectData,LocalFree,	0_2_000001EF1F1D5EE0

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.7:49700 version: TLS 1.2

Source: unique.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F259810 FindClose,FindFirstFileExW,GetLastError,		0_2_000001EF1F259810
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F2598C0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		0_2_000001EF1F2598C0

Source: C:\Users\user\Desktop\unique.exe

Code function: 0_2_000001EF1F2213B0 GetLogicalDriveStringsW,

0_2_000001EF1F2213B0

Source: C:\Users\user\Desktop\unique.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.7:49699 -> 45.130.145.152:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.7:49699 -> 45.130.145.152:15666

Source: global traffic

TCP traffic: 192.168.2.7:49699 -> 45.130.145.152:15666

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 45.130.145.152 45.130.145.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: ASBAXETNRU ASBAXETNRU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.7:49699 -> 45.130.145.152:15666

Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152

Source: C:\Users\user\Desktop\unique.exe

Code function: 0_2_000001EF1F21F200 InternetOpenA,InternetOpenUrlA,HttpQueryInfoW,HttpQueryInfoW,InternetQueryDataAvailable,InternetReadFile,InternetQueryDataAvailable,InternetCloseHandle,Concurrency::cancel_current_task,

0_2_000001EF1F21F200

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: unique.exe, 00000000.00000003.1490195161.000001EF1F6E4000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1490145991.000001EF1F6E0000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1490111404.000001EF1F6E0000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1276151481.000001EF1F6D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsoft.t/Regi
Source: unique.exe, 00000000.00000002.1491224091.000001EF1F070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: unique.exe, 00000000.00000002.1491224091.000001EF1F070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: unique.exe, 00000000.00000003.1290197593.000001EF1D7A2000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289100148.000001EF1FE6A000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289922829.000001EF1D77E000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289922829.000001EF1D74D000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289612684.000001EF1FE6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: unique.exe, 00000000.00000003.1290197593.000001EF1D7A2000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289100148.000001EF1FE6A000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289922829.000001EF1D77E000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289922829.000001EF1D74D000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289612684.000001EF1FE6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: unique.exe, 00000000.00000003.1290197593.000001EF1D7A2000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289100148.000001EF1FE6A000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289922829.000001EF1D77E000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289922829.000001EF1D74D000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289612684.000001EF1FE6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: unique.exe, 00000000.00000003.1290197593.000001EF1D7A2000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289100148.000001EF1FE6A000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289922829.000001EF1D77E000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289922829.000001EF1D74D000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289612684.000001EF1FE6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: unique.exe, 00000000.00000003.1278377282.000001EF1F10F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: unique.exe, 00000000.00000003.1278377282.000001EF1F10F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: unique.exe, 00000000.00000003.1278377282.000001EF1F10F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: unique.exe, 00000000.00000003.1289612684.000001EF1FE6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: unique.exe, 00000000.00000003.1282860551.000001EF1F400000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1285313977.000001EF207BE000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1282073578.000001EF1FEEE000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1282430928.000001EF1F4C8000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1283805465.000001EF1F11F000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1283976216.000001EF1D7D6000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1283805465.000001EF1F127000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1282073578.000001EF1FEE6000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1282860551.000001EF1F408000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1282430928.000001EF1F4C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: unique.exe, 00000000.00000003.1285313977.000001EF207C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: unique.exe, 00000000.00000003.1285313977.000001EF207C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: unique.exe, 00000000.00000003.1290197593.000001EF1D7A2000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289100148.000001EF1FE6A000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289922829.000001EF1D77E000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289922829.000001EF1D74D000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289612684.000001EF1FE6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: unique.exe, 00000000.00000003.1290197593.000001EF1D7A2000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289100148.000001EF1FE6A000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289922829.000001EF1D77E000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289922829.000001EF1D74D000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289612684.000001EF1FE6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: unique.exe, 00000000.00000003.1282860551.000001EF1F400000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1285313977.000001EF207BE000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1282073578.000001EF1FEEE000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1282430928.000001EF1F4C8000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1283805465.000001EF1F11F000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1283976216.000001EF1D7D6000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1283805465.000001EF1F127000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1282073578.000001EF1FEE6000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1282860551.000001EF1F408000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1282430928.000001EF1F4C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: unique.exe, 00000000.00000003.1285313977.000001EF207C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: unique.exe, 00000000.00000003.1285313977.000001EF207C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: unique.exe, 00000000.00000003.1283805465.000001EF1F12F000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1282430928.000001EF1F4D0000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1282073578.000001EF1FEF6000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1282860551.000001EF1F410000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1285313977.000001EF207C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: unique.exe, 00000000.00000003.1285313977.000001EF207C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: unique.exe, 00000000.00000003.1283805465.000001EF1F12F000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1282430928.000001EF1F4D0000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1282073578.000001EF1FEF6000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1282860551.000001EF1F410000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1285313977.000001EF207C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.7:49700 version: TLS 1.2

Source: C:\Users\user\Desktop\unique.exe

Code function: 0_2_000001EF1F21FB30 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,EnterCriticalSection,LeaveCriticalSection,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

0_2_000001EF1F21FB30

Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F2243F0 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,	0_2_000001EF1F2243F0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F223CF0 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,	0_2_000001EF1F223CF0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F2726D0 NtQuerySystemInformation,	0_2_000001EF1F2726D0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F2726E0 NtAllocateVirtualMemory,	0_2_000001EF1F2726E0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E634C0 NtQueryVirtualMemory,NtProtectVirtualMemory,	0_2_00007FF617E634C0

Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F201340	0_2_000001EF1F201340
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1E22D0	0_2_000001EF1F1E22D0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F24114C	0_2_000001EF1F24114C
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1CF1C0	0_2_000001EF1F1CF1C0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F21F200	0_2_000001EF1F21F200
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F2270B0	0_2_000001EF1F2270B0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1DCF60	0_2_000001EF1F1DCF60
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F218F60	0_2_000001EF1F218F60
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F221FF0	0_2_000001EF1F221FF0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1DACC0	0_2_000001EF1F1DACC0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F21FB30	0_2_000001EF1F21FB30
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F228B70	0_2_000001EF1F228B70
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F25E968	0_2_000001EF1F25E968
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1DB820	0_2_000001EF1F1DB820
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F220820	0_2_000001EF1F220820
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F2598C0	0_2_000001EF1F2598C0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1DC8C0	0_2_000001EF1F1DC8C0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1CF8B0	0_2_000001EF1F1CF8B0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F22662B	0_2_000001EF1F22662B
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F221660	0_2_000001EF1F221660
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F22C55A	0_2_000001EF1F22C55A
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F23749C	0_2_000001EF1F23749C
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1EE320	0_2_000001EF1F1EE320
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F2413C8	0_2_000001EF1F2413C8
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F2243F0	0_2_000001EF1F2243F0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1C83D0	0_2_000001EF1F1C83D0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F218230	0_2_000001EF1F218230
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F25E2CC	0_2_000001EF1F25E2CC
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F20D2A0	0_2_000001EF1F20D2A0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1D02E0	0_2_000001EF1F1D02E0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F20C300	0_2_000001EF1F20C300
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F272138	0_2_000001EF1F272138
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1D6130	0_2_000001EF1F1D6130
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1EE130	0_2_000001EF1F1EE130
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1A6180	0_2_000001EF1F1A6180
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F272158	0_2_000001EF1F272158
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F272160	0_2_000001EF1F272160
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F2101F0	0_2_000001EF1F2101F0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F2151E0	0_2_000001EF1F2151E0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1DA1F0	0_2_000001EF1F1DA1F0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F20F040	0_2_000001EF1F20F040
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F235044	0_2_000001EF1F235044
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F237060	0_2_000001EF1F237060
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1D9090	0_2_000001EF1F1D9090
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F20CF70	0_2_000001EF1F20CF70
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F208F53	0_2_000001EF1F208F53
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F21AE50	0_2_000001EF1F21AE50
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F249EA0	0_2_000001EF1F249EA0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1CFEE0	0_2_000001EF1F1CFEE0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1A6D20	0_2_000001EF1F1A6D20
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F244D78	0_2_000001EF1F244D78
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F20FDB0	0_2_000001EF1F20FDB0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F230D98	0_2_000001EF1F230D98
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1A5DB0	0_2_000001EF1F1A5DB0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F23EE06	0_2_000001EF1F23EE06
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F238C34	0_2_000001EF1F238C34
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F20CC50	0_2_000001EF1F20CC50
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F232CD0	0_2_000001EF1F232CD0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1D7B8D	0_2_000001EF1F1D7B8D
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1F9A10	0_2_000001EF1F1F9A10
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F20C930	0_2_000001EF1F20C930
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F246984	0_2_000001EF1F246984
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F208950	0_2_000001EF1F208950
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F2419B8	0_2_000001EF1F2419B8
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F2429F4	0_2_000001EF1F2429F4
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F234A00	0_2_000001EF1F234A00
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1EC820	0_2_000001EF1F1EC820
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F23088C	0_2_000001EF1F23088C
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F2128C0	0_2_000001EF1F2128C0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F2358D0	0_2_000001EF1F2358D0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F224740	0_2_000001EF1F224740
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F204710	0_2_000001EF1F204710
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F248777	0_2_000001EF1F248777
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F216760	0_2_000001EF1F216760
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F23F7F4	0_2_000001EF1F23F7F4
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F2347FC	0_2_000001EF1F2347FC
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1A6610	0_2_000001EF1F1A6610
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F22B68A	0_2_000001EF1F22B68A
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1F66A0	0_2_000001EF1F1F66A0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F2106A6	0_2_000001EF1F2106A6
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F2486F0	0_2_000001EF1F2486F0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F23E6F8	0_2_000001EF1F23E6F8
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1E86D0	0_2_000001EF1F1E86D0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1C5520	0_2_000001EF1F1C5520
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1C6510	0_2_000001EF1F1C6510
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F1F55B0	0_2_000001EF1F1F55B0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F2345F8	0_2_000001EF1F2345F8
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F20C600	0_2_000001EF1F20C600
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F24A438	0_2_000001EF1F24A438
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F220500	0_2_000001EF1F220500
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F2454E8	0_2_000001EF1F2454E8
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617EB28CC	0_2_00007FF617EB28CC
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617EAC8B4	0_2_00007FF617EAC8B4
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617EA6844	0_2_00007FF617EA6844
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E9F7EC	0_2_00007FF617E9F7EC
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617EA07B4	0_2_00007FF617EA07B4
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E827B0	0_2_00007FF617E827B0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617EA8758	0_2_00007FF617EA8758
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E76730	0_2_00007FF617E76730
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E766E0	0_2_00007FF617E766E0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E9C550	0_2_00007FF617E9C550
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617EAA448	0_2_00007FF617EAA448
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617EA23EC	0_2_00007FF617EA23EC
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617EA7358	0_2_00007FF617EA7358
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E922E8	0_2_00007FF617E922E8
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617EA02A8	0_2_00007FF617EA02A8
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E981D0	0_2_00007FF617E981D0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E9A140	0_2_00007FF617E9A140
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617EA4110	0_2_00007FF617EA4110
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E830B0	0_2_00007FF617E830B0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617EB209C	0_2_00007FF617EB209C
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E9AF56	0_2_00007FF617E9AF56
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E9CFA0	0_2_00007FF617E9CFA0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E97F90	0_2_00007FF617E97F90
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617EAFF2C	0_2_00007FF617EAFF2C
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E9CEB2	0_2_00007FF617E9CEB2
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617EC3DA0	0_2_00007FF617EC3DA0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617EA9CD8	0_2_00007FF617EA9CD8
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617EA6CD8	0_2_00007FF617EA6CD8
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E94C30	0_2_00007FF617E94C30
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E98C30	0_2_00007FF617E98C30
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E99C10	0_2_00007FF617E99C10
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E9FBF4	0_2_00007FF617E9FBF4
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E92B97	0_2_00007FF617E92B97
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617EAFA90	0_2_00007FF617EAFA90
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E9CA20	0_2_00007FF617E9CA20
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E9F9F0	0_2_00007FF617E9F9F0
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E739E0	0_2_00007FF617E739E0

Source: C:\Users\user\Desktop\unique.exe	Code function: String function: 000001EF1F1E5330 appears 74 times
Source: C:\Users\user\Desktop\unique.exe	Code function: String function: 000001EF1F1CB930 appears 32 times
Source: C:\Users\user\Desktop\unique.exe	Code function: String function: 000001EF1F1D4C00 appears 41 times
Source: C:\Users\user\Desktop\unique.exe	Code function: String function: 00007FF617E751F0 appears 69 times

Source: classification engine

Classification label: mal100.troj.spyw.winEXE@1/0@1/2

Source: C:\Users\user\Desktop\unique.exe

Code function: 0_2_000001EF1F225970 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,

0_2_000001EF1F225970

Source: C:\Users\user\Desktop\unique.exe

Code function: 0_2_000001EF1F1DC8C0 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_000001EF1F1DC8C0

Source: C:\Users\user\Desktop\unique.exe

Code function: 0_2_000001EF1F20F1B5 CoCreateInstance,

0_2_000001EF1F20F1B5

Source: C:\Users\user\Desktop\unique.exe

Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E6963523BF477

Source: unique.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\unique.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unique.exe, 00000000.00000003.1281264293.000001EF1D7C7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unique.exe

ReversingLabs: Detection: 55%

Source: C:\Users\user\Desktop\unique.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\unique.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\unique.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: unique.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: unique.exe

Static file information: File size 3341824 > 1048576

Source: unique.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x2bd800

Source: unique.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: unique.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: unique.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: unique.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: unique.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: unique.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: unique.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: unique.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: unique.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: unique.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: unique.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: unique.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: unique.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\unique.exe

Code function: 0_2_000001EF1F1DB820 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_000001EF1F1DB820

Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F21E874 push rbx; iretd	0_2_000001EF1F21E875
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F21E89C push rbx; iretd	0_2_000001EF1F21E89D
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E9D8A1 push rdi; ret	0_2_00007FF617E9D8A5
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E9D2C0 push rcx; iretd	0_2_00007FF617E9D2C1
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E9DB93 push rcx; iretd	0_2_00007FF617E9DB94
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617E9DB8C push rdi; ret	0_2_00007FF617E9DB90

Source: C:\Users\user\Desktop\unique.exe

Code function: 0_2_000001EF1F216480 ExitProcess,OpenMutexA,ExitProcess,CreateMutexA,CreateMutexExA,ExitProcess,ReleaseMutex,CloseHandle,

0_2_000001EF1F216480

Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F259810 FindClose,FindFirstFileExW,GetLastError,		0_2_000001EF1F259810
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F2598C0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		0_2_000001EF1F2598C0

Source: C:\Users\user\Desktop\unique.exe

Code function: 0_2_000001EF1F2213B0 GetLogicalDriveStringsW,

0_2_000001EF1F2213B0

Source: C:\Users\user\Desktop\unique.exe

Code function: 0_2_000001EF1F237348 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

0_2_000001EF1F237348

Source: C:\Users\user\Desktop\unique.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: unique.exe, 00000000.00000003.1277974859.000001EF1D736000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1277514996.000001EF1D733000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000002.1490762787.000001EF1D736000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000002.1491224091.000001EF1F070000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1278758252.000001EF1D736000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: unique.exe, 00000000.00000003.1280542780.000001EF1D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\unique.exe	API call chain: ExitProcess graph end node			graph_0-97670
Source: C:\Users\user\Desktop\unique.exe	API call chain: ExitProcess graph end node			graph_0-97664

Source: C:\Users\user\Desktop\unique.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\unique.exe

Code function: 0_2_000001EF1F2243F0 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,

0_2_000001EF1F2243F0

Source: C:\Users\user\Desktop\unique.exe

Code function: 0_2_000001EF1F25BB14 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_000001EF1F25BB14

Source: C:\Users\user\Desktop\unique.exe

Code function: 0_2_000001EF1F25BB14 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_000001EF1F25BB14

Source: C:\Users\user\Desktop\unique.exe

Code function: 0_2_000001EF1F1DB820 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_000001EF1F1DB820

Source: C:\Users\user\Desktop\unique.exe

Code function: 0_2_000001EF1F247F00 GetProcessHeap,

0_2_000001EF1F247F00

Source: C:\Users\user\Desktop\unique.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F2722D8 SetUnhandledExceptionFilter,	0_2_000001EF1F2722D8
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F22F920 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000001EF1F22F920
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_000001EF1F24D54C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000001EF1F24D54C
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617EA1E68 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF617EA1E68
Source: C:\Users\user\Desktop\unique.exe	Code function: 0_2_00007FF617EB5AC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF617EB5AC0

Source: C:\Users\user\Desktop\unique.exe

Code function: 0_2_000001EF1F2151E0 ShellExecuteW,

0_2_000001EF1F2151E0

Source: C:\Users\user\Desktop\unique.exe

Code function: 0_2_000001EF1F24C220 cpuid

0_2_000001EF1F24C220

Source: C:\Users\user\Desktop\unique.exe	Code function: EnumSystemLocalesW,	0_2_000001EF1F247340
Source: C:\Users\user\Desktop\unique.exe	Code function: GetLocaleInfoW,	0_2_000001EF1F272398
Source: C:\Users\user\Desktop\unique.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_000001EF1F2473D8
Source: C:\Users\user\Desktop\unique.exe	Code function: EnumSystemLocalesW,	0_2_000001EF1F247270
Source: C:\Users\user\Desktop\unique.exe	Code function: GetLocaleInfoW,	0_2_000001EF1F23C1A8
Source: C:\Users\user\Desktop\unique.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_000001EF1F246F14
Source: C:\Users\user\Desktop\unique.exe	Code function: EnumSystemLocalesW,	0_2_000001EF1F23BC68
Source: C:\Users\user\Desktop\unique.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_000001EF1F24795C
Source: C:\Users\user\Desktop\unique.exe	Code function: GetLocaleInfoW,	0_2_000001EF1F247828
Source: C:\Users\user\Desktop\unique.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_000001EF1F247778
Source: C:\Users\user\Desktop\unique.exe	Code function: GetLocaleInfoW,	0_2_000001EF1F247620
Source: C:\Users\user\Desktop\unique.exe	Code function: GetLocaleInfoEx,FormatMessageA,	0_2_000001EF1F259480
Source: C:\Users\user\Desktop\unique.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF617EAD88C
Source: C:\Users\user\Desktop\unique.exe	Code function: GetLocaleInfoW,	0_2_00007FF617EAD758
Source: C:\Users\user\Desktop\unique.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF617EAD6A8
Source: C:\Users\user\Desktop\unique.exe	Code function: GetLocaleInfoW,	0_2_00007FF617EAD550
Source: C:\Users\user\Desktop\unique.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF617EAD308
Source: C:\Users\user\Desktop\unique.exe	Code function: EnumSystemLocalesW,	0_2_00007FF617EAD270
Source: C:\Users\user\Desktop\unique.exe	Code function: GetLocaleInfoW,	0_2_00007FF617EA91E0
Source: C:\Users\user\Desktop\unique.exe	Code function: EnumSystemLocalesW,	0_2_00007FF617EAD1A0
Source: C:\Users\user\Desktop\unique.exe	Code function: EnumSystemLocalesW,	0_2_00007FF617EA8E4C
Source: C:\Users\user\Desktop\unique.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF617EACE44

Source: C:\Users\user\Desktop\unique.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\unique.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\Desktop\unique.exe

Code function: 0_2_000001EF1F24DC18 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_000001EF1F24DC18

Source: C:\Users\user\Desktop\unique.exe

Code function: 0_2_000001EF1F220110 GetUserNameW,

0_2_000001EF1F220110

Source: C:\Users\user\Desktop\unique.exe

Code function: 0_2_000001EF1F24114C _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_000001EF1F24114C

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: unique.exe PID: 7344, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.unique.exe.1ef1f1a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.unique.exe.1ef1f1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1491224091.000001EF1F070000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: unique.exe PID: 7344, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: unique.exe, 00000000.00000002.1491224091.000001EF1F070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum-LTC\wallets
Source: unique.exe, 00000000.00000002.1491224091.000001EF1F070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\wallets
Source: unique.exe, 00000000.00000003.1310366744.000001EF2279B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "software": "Ny1aaXAgMjMuMDEgKHg2NCkgWzIzLjAxXQpNb3ppbGxhIEZpcmVmb3ggKHg2NCBlbi1VUykgWzExOC4wLjFdCk1vemlsbGEgTWFpbnRlbmFuY2UgU2VydmljZSBbMTE4LjAuMV0KTWljcm9zb2Z0IE9mZmljZSBQcm9mZXNzaW9uYWwgUGx1cyAyMDE5IC0gZW4tdXMgWzE2LjAuMTY4MjcuMjAxMzBdCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMjIgWDY0IEFkZGl0aW9uYWwgUnVudGltZSAtIDE0LjM2LjMyNTMyIFsxNC4zNi4zMjUzMl0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBMaWNlbnNpbmcgQ29tcG9uZW50IFsxNi4wLjE2ODI3LjIwMTMwXQpPZmZpY2UgMTYgQ2xpY2stdG8tUnVuIEV4dGVuc2liaWxpdHkgQ29tcG9uZW50IDY0LWJpdCBSZWdpc3RyYXRpb24gWzE2LjAuMTY4MjcuMjAwNTZdCkFkb2JlIEFjcm9iYXQgKDY0LWJpdCkgWzIzLjAwNi4yMDMyMF0KTWljcm9zb2Z0IFZpc3VhbCBDKysgMjAyMiBYNjQgTWluaW11bSBSdW50aW1lIC0gMTQuMzYuMzI1MzIgWzE0LjM2LjMyNTMyXQpHb29nbGUgQ2hyb21lIFsxMTcuMC41OTM4LjEzNF0KTWljcm9zb2Z0IEVkZ2UgWzExNy4wLjIwNDUuNDddCk1pY3Jvc29mdCBFZGdlIFVwZGF0ZSBbMS4zLjE3Ny4xMV0KTWljcm9zb2Z0IEVkZ2UgV2ViVmlldzIgUnVudGltZSBbMTE3LjAuMjA0NS40N10KSmF2YSBBdXRvIFVwZGF0ZXIgWzIuOC4zODEuOV0KSmF2YSA4IFVwZGF0ZSAzODEgWzguMC4zODEwLjldCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMTUtMjAyMiBSZWRpc3RyaWJ1dGFibGUgKHg2NCkgLSAxNC4zNi4zMjUzMiBbMTQuMzYuMzI1MzIuMF0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBFeHRlbnNpYmlsaXR5IENvbXBvbmVudCBbMTYuMC4xNjgyNy4yMDEzMF0K",
Source: unique.exe, 00000000.00000003.1289922829.000001EF1D77E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.walletser
Source: unique.exe, 00000000.00000003.1289922829.000001EF1D77E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\keystorerowser
Source: unique.exe, 00000000.00000002.1491224091.000001EF1F070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: unique.exe, 00000000.00000003.1289922829.000001EF1D77E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\walletsser
Source: unique.exe, 00000000.00000002.1491224091.000001EF1F070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: unique.exe, 00000000.00000002.1491224091.000001EF1F070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\unique.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\unique.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\unique.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\unique.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: unique.exe PID: 7344, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.unique.exe.1ef1f1a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.unique.exe.1ef1f1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1491224091.000001EF1F070000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: unique.exe PID: 7344, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Access Token Manipulation	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	1 Email Collection	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	2 Obfuscated Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Account Discovery	Distributed Component Object Model	2 Data from Local System	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	3 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	34 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
unique.exe	55%	ReversingLabs	Win64.Spyware.Meduzastealer

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	172.67.74.152	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	unique.exe, 00000000.00000003.1290197593.000001EF1D7A2000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289100148.000001EF1FE6A000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289922829.000001EF1D77E000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289922829.000001EF1D74D000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289612684.000001EF1FE6B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	unique.exe, 00000000.00000003.1278377282.000001EF1F10F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.ipify.org	unique.exe, 00000000.00000002.1491224091.000001EF1F070000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	unique.exe, 00000000.00000003.1278377282.000001EF1F10F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	unique.exe, 00000000.00000003.1290197593.000001EF1D7A2000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289100148.000001EF1FE6A000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289922829.000001EF1D77E000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289922829.000001EF1D74D000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289612684.000001EF1FE6B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	unique.exe, 00000000.00000003.1290197593.000001EF1D7A2000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289100148.000001EF1FE6A000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289922829.000001EF1D77E000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289922829.000001EF1D74D000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289612684.000001EF1FE6B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	unique.exe, 00000000.00000003.1290197593.000001EF1D7A2000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289100148.000001EF1FE6A000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289922829.000001EF1D77E000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289922829.000001EF1D74D000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289612684.000001EF1FE6B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	unique.exe, 00000000.00000003.1289612684.000001EF1FE6B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	unique.exe, 00000000.00000003.1278377282.000001EF1F10F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	unique.exe, 00000000.00000003.1290197593.000001EF1D7A2000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289100148.000001EF1FE6A000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289922829.000001EF1D77E000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289922829.000001EF1D74D000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289612684.000001EF1FE6B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org	unique.exe, 00000000.00000003.1282860551.000001EF1F400000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1285313977.000001EF207BE000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1282073578.000001EF1FEEE000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1282430928.000001EF1F4C8000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1283805465.000001EF1F11F000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1283976216.000001EF1D7D6000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1283805465.000001EF1F127000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1282073578.000001EF1FEE6000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1282860551.000001EF1F408000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1282430928.000001EF1F4C0000.00000004.00000020.00020000.00000000.sdmp	false	high
http://ns.microsoft.t/Regi	unique.exe, 00000000.00000003.1490195161.000001EF1F6E4000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1490145991.000001EF1F6E0000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1490111404.000001EF1F6E0000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1276151481.000001EF1F6D1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	unique.exe, 00000000.00000003.1285313977.000001EF207C5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	unique.exe, 00000000.00000003.1285313977.000001EF207C5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	unique.exe, 00000000.00000003.1290197593.000001EF1D7A2000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289100148.000001EF1FE6A000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289922829.000001EF1D77E000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289922829.000001EF1D74D000.00000004.00000020.00020000.00000000.sdmp, unique.exe, 00000000.00000003.1289612684.000001EF1FE6B000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.130.145.152	unknown	Russian Federation		49392	ASBAXETNRU	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1565322
Start date and time:	2024-11-29 16:06:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	unique.exe
Detection:	MAL
Classification:	mal100.troj.spyw.winEXE@1/0@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 101 Number of non-executed functions: 115
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: unique.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.130.145.152	siveria.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	chelentano.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	bv2DbIiZeK.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	brozer.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	YU7jHNMJjG.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	6Ev0Nd7z2t.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	6HWYiong4s.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
172.67.74.152	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Zc9eO57fgF.elf	Get hash	malicious	Unknown	Browse	api.ipify.org/
	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	4F08j2Rmd9.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	y8tCHz7CwC.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	siveria.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	https://google.lk/url?q=ernie.grue@nationalmi.com&nationalmi.com&sa=t&url=amp/s/i--iy.s3.us-east-1.amazonaws.com/vocabulary.html#ZXJuaWUuZ3J1ZUBuYXRpb25hbG1pLmNvbQ==	Get hash	malicious	Unknown	Browse	104.26.12.205
	Employee_Important_Message.pdf	Get hash	malicious	Unknown	Browse	104.26.12.205
	9arEd0o4IZ.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	IwSa5fjMWm.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	051qAVqlq9.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	rkGw58sHF5.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	Vr39ff92jh.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	LBswoftSFF.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	3lpDhNtVKt.exe	Get hash	malicious	Unknown	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASBAXETNRU	siveria.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	1732748284fd56a2da13edf4ae4b865c44fa6834581d27eb2edbfe3fc50ef131cb95db5639506.dat-decoded.exe	Get hash	malicious	Remcos	Browse	45.135.232.38
	mips.elf	Get hash	malicious	Unknown	Browse	212.192.15.158
	chelentano.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	m2.exe	Get hash	malicious	Xmrig	Browse	194.87.31.45
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	bv2DbIiZeK.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	brozer.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
CLOUDFLARENETUS	siveria.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	https://google.lk/url?q=ernie.grue@nationalmi.com&nationalmi.com&sa=t&url=amp/s/i--iy.s3.us-east-1.amazonaws.com/vocabulary.html#ZXJuaWUuZ3J1ZUBuYXRpb25hbG1pLmNvbQ==	Get hash	malicious	Unknown	Browse	104.26.13.205
	file.ps1	Get hash	malicious	LummaC Stealer	Browse	172.67.170.85
	IMG_1205 #U2014 ThingLink.html	Get hash	malicious	Unknown	Browse	104.18.41.175
	bUAmCazc.ps1	Get hash	malicious	LummaC Stealer	Browse	172.67.170.85
	http://myhobbybuys.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://29112024red01kamcjduq.z33.web.core.windows.net	Get hash	malicious	TechSupportScam	Browse	104.17.25.14
	http://antena1.rtp.pt	Get hash	malicious	RATDispenser	Browse	104.22.62.150
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	https://herald-review.com/users/logout-success/?expire=1626371676&referer_url=http://209.159.152.50	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	siveria.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	172.67.74.152
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	172.67.74.152
	pPLD6OSn7O.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	pPLD6OSn7O.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	0b3SUiWz3y.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	ww7Oxm9pwx.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	file.exe	Get hash	malicious	Vidar	Browse	172.67.74.152
	0b3SUiWz3y.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	ww7Oxm9pwx.exe	Get hash	malicious	Unknown	Browse	172.67.74.152

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	4.216400575454824
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	unique.exe
File size:	3'341'824 bytes
MD5:	814a59368670f8d35ad8eb71ab874666
SHA1:	ca386125774e35b84c16bacfbe52919a354434ac
SHA256:	98d8aa77d46e09b79c04b5f4556b1d389c6f62549a5ac0f961a6d8f2961fa55d
SHA512:	57c30c5838a59f7d82343d40cbb539a1405485f51ceaf6350c52b27b1e54d5a9c9e2b8e08a8a73644e1ddd2733135128b1339c53676ba770a3bd0d69f33c192f
SSDEEP:	24576:S/frmzI7lsX7Rh7lmXh0lhSMXlWuZndKjOg4eMLbjxMQ2PEpnjaJ9:KfrmzI7OXBGu+ybjxGaja
TLSH:	84F5AD67EE9064F2D874D13488A3076BBA767481C37183C75B88662A5F527E43F3AF84
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N..f...5...5...5.x.4...5.x.4...5.x.4V..5A..4...5A..4...5A..4...52\|.4$..52\|.4...5By.4...5A..4...5...5...5Ay.4...5AyH5...5Ay.4...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140055a30
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67451F50 [Tue Nov 26 01:07:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	de1751741e7d5e07ce98493d3f0130fc

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F21E87B3A0Ch
dec eax
add esp, 28h
jmp 00007F21E87B2D8Fh
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007F21E87B2F22h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007F21E87B2F25h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007F21E87B2F1Dh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007F21E87B2956h
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0001563Fh]
dec eax
mov ecx, ebx
call dword ptr [0001562Eh]
call dword ptr [000155B0h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00015624h]
dec eax
mov dword ptr [esp+00h], ecx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x327b9c	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x332000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x32c000	0x57e4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x333000	0x1d38	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x320ef0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x321100	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x320db0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x6b000	0x330	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x692f0	0x69400	201d673c76ad9fae647f8cd6a278e333	False	0.4342200489904988	data	6.181155425260236	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x6b000	0x2bd696	0x2bd800	fd84b474fc2b5d511c79aef4a401aa86	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x329000	0x2f1c	0x1600	8e0cf2168d43982c322bc34eed94de2b	False	0.18980823863636365	data	3.2059756111359152	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x32c000	0x57e4	0x5800	4c0d14150dd6a4ac35b35408d7a8233d	False	0.47767223011363635	data	5.711183919097264	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x332000	0x1e0	0x200	0c1ab865bc43ec75ebd479502575ccef	False	0.525390625	data	4.700456763479242	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x333000	0x1d38	0x1e00	3d9cd06dc9d02c11c130514ad02ec0c5	False	0.6712239583333334	data	6.471011674882192	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x332060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
ntdll.dll	RtlImageDirectoryEntryToData, RtlLeaveCriticalSection, RtlEnterCriticalSection, RtlCompareMemory, NtProtectVirtualMemory, RtlImageNtHeader, NtQueryVirtualMemory, RtlGetNtVersionNumbers
KERNEL32.dll	GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, FindNextFileW, FindFirstFileExW, FindClose, VirtualFree, VirtualAlloc, GetModuleHandleW, LoadLibraryA, ReadFile, WriteFile, CreateFileW, CloseHandle, GetProcAddress, GetCurrentProcess, VirtualQuery, EnterCriticalSection, GetModuleFileNameW, LeaveCriticalSection, MultiByteToWideChar, ExitProcess, WideCharToMultiByte, GetLastError, DeleteCriticalSection, SetLastError, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, GetSystemTimeAsFileTime, HeapAlloc, HeapFree, GetCurrentThreadId, GetStdHandle, GetFileType, FreeEnvironmentStringsW, RaiseException, HeapReAlloc, HeapSize, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, InitializeCriticalSectionAndSpinCount, FreeLibrary, LoadLibraryExW, LCMapStringW, GetLocaleInfoW, IsValidLocale, EnumSystemLocalesW, GetCPInfo, GetStringTypeW, IsValidCodePage, GetACP, GetOEMCP, GetModuleHandleExW, GetConsoleOutputCP, GetConsoleMode, GetFileSizeEx, SetFilePointerEx, GetProcessHeap, SetStdHandle, ReadConsoleW, FlushFileBuffers, WriteConsoleW, QueryPerformanceCounter, GetCurrentProcessId, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, RtlUnwind, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetUserDefaultLCID, InitializeCriticalSectionEx, DecodePointer, LCMapStringEx
USER32.dll	LoadAcceleratorsA, LoadAcceleratorsW
ADVAPI32.dll	GetTokenInformation, OpenProcessToken

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-29T16:07:06.069806+0100	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.7	49699	45.130.145.152	15666	TCP
2024-11-29T16:07:06.069806+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.7	49699	45.130.145.152	15666	TCP
2024-11-29T16:07:06.069806+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.7	49699	45.130.145.152	15666	TCP
2024-11-29T16:07:06.190295+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.7	49699	45.130.145.152	15666	TCP
2024-11-29T16:07:06.190295+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.7	49699	45.130.145.152	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2024 16:06:59.939435959 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:00.059547901 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:00.059628963 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:00.267242908 CET	49700	443	192.168.2.7	172.67.74.152
Nov 29, 2024 16:07:00.267319918 CET	443	49700	172.67.74.152	192.168.2.7
Nov 29, 2024 16:07:00.267395020 CET	49700	443	192.168.2.7	172.67.74.152
Nov 29, 2024 16:07:00.276581049 CET	49700	443	192.168.2.7	172.67.74.152
Nov 29, 2024 16:07:00.276599884 CET	443	49700	172.67.74.152	192.168.2.7
Nov 29, 2024 16:07:01.503614902 CET	443	49700	172.67.74.152	192.168.2.7
Nov 29, 2024 16:07:01.503750086 CET	49700	443	192.168.2.7	172.67.74.152
Nov 29, 2024 16:07:01.844033003 CET	49700	443	192.168.2.7	172.67.74.152
Nov 29, 2024 16:07:01.844079971 CET	443	49700	172.67.74.152	192.168.2.7
Nov 29, 2024 16:07:01.844588041 CET	443	49700	172.67.74.152	192.168.2.7
Nov 29, 2024 16:07:01.844650984 CET	49700	443	192.168.2.7	172.67.74.152
Nov 29, 2024 16:07:01.846040964 CET	49700	443	192.168.2.7	172.67.74.152
Nov 29, 2024 16:07:01.887341976 CET	443	49700	172.67.74.152	192.168.2.7
Nov 29, 2024 16:07:02.182327986 CET	443	49700	172.67.74.152	192.168.2.7
Nov 29, 2024 16:07:02.182400942 CET	49700	443	192.168.2.7	172.67.74.152
Nov 29, 2024 16:07:02.182416916 CET	443	49700	172.67.74.152	192.168.2.7
Nov 29, 2024 16:07:02.182461023 CET	49700	443	192.168.2.7	172.67.74.152
Nov 29, 2024 16:07:02.183063030 CET	49700	443	192.168.2.7	172.67.74.152
Nov 29, 2024 16:07:02.183080912 CET	443	49700	172.67.74.152	192.168.2.7
Nov 29, 2024 16:07:06.069806099 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.190201998 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.190224886 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.190260887 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.190275908 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.190294981 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.190345049 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.190362930 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.190376043 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.190427065 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.190470934 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.190566063 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.190598011 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.190599918 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.190629959 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.190654039 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.190680027 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.190706015 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.310484886 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.310506105 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.310520887 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.310543060 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.310560942 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.310610056 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.310664892 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.310692072 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.310749054 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.310782909 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.310903072 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.310982943 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.311007023 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.311045885 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.311079025 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.311131954 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.311146021 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.311194897 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.311227083 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.311265945 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.311289072 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.311330080 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.430737019 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.430787086 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.430803061 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.430835009 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.430887938 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.430891037 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.430938959 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.430999994 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.431133032 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.431143045 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.431143045 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.431222916 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.431349039 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.431411982 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.431436062 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.431441069 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.431447983 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.431456089 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.431473017 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.431550980 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.431597948 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.431607008 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.431679964 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.431679964 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.431691885 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.431766033 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.431827068 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.431837082 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.431898117 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.431905985 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.431906939 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.431993961 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.432037115 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.432045937 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.432121992 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.432132959 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.432153940 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.432229042 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.551100016 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.551120996 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.551153898 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.551166058 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.551192045 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.551203012 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.551246881 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.551251888 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.551264048 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.551282883 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.551352978 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.551363945 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.551389933 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.551430941 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.551441908 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.551470041 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.551511049 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.551547050 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.551558971 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.551611900 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.551632881 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.551691055 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.551738024 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.551748991 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.551778078 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.551789045 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.551801920 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.551836967 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.551918030 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.551930904 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.551995039 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.552016973 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.552028894 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.552038908 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.552078009 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.552089930 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.552115917 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.552138090 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.552162886 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.552176952 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.552252054 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.552264929 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.552289963 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.552323103 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.552373886 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.552377939 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.552448034 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.552480936 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.552545071 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.552582026 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.552593946 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.552603960 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.552614927 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.552628040 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.552651882 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.552659035 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.552680016 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.552733898 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.552750111 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.552762032 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.552783966 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.552795887 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.552798986 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.552826881 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.552884102 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.552896976 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.552911997 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.552933931 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.552943945 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.552948952 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.552990913 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.553004980 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.553016901 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.553030968 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.553056002 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.553083897 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.553138018 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.553167105 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.553188086 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.553216934 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.553406954 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.553420067 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.553437948 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.553463936 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.553498983 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.553510904 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.553534985 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.553546906 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.553560019 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.553576946 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.553589106 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.553591013 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.553617001 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.553630114 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.553663015 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.553666115 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.553695917 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.553716898 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.553751945 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.553771019 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.553781986 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.553824902 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.553836107 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.553845882 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.553847075 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.553899050 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.671392918 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.671427965 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.671472073 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.671509981 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.671533108 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.671564102 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.671614885 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.671623945 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.671648026 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.671736956 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.671770096 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.671804905 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.671823978 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.671863079 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.671873093 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.671888113 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.672014952 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.672020912 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.672051907 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.672199011 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.672236919 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.672343969 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.672480106 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.672524929 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.672569036 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.672687054 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.672709942 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.672750950 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.672755003 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.672910929 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.672997952 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.673036098 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.673064947 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.673248053 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.673324108 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.673525095 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.673559904 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.673633099 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.673644066 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.673765898 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.673770905 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.673798084 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.673826933 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.673835039 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.673842907 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.673882961 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.673917055 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.673962116 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.674004078 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.674011946 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.674046993 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.674065113 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.674108982 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.674109936 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.674173117 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.674295902 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.674400091 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.674408913 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.674449921 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.674489975 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.674550056 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.674577951 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.674578905 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.674606085 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.674671888 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.674679995 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.674693108 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.674770117 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.674787045 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.674801111 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.674812078 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.674851894 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.674889088 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.674916983 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.674954891 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.674954891 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.675102949 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.675113916 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.675199032 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.675234079 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.675245047 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.675275087 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.675283909 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.675376892 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.675385952 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.675386906 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.675457001 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.675508022 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.675515890 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.675571918 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.675627947 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.675676107 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.675765038 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.675782919 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.675803900 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.675909042 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.675918102 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.675945044 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.676012039 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.676021099 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.676037073 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.676112890 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.676152945 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.676188946 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.676203966 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.676215887 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.676275015 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.676284075 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.676312923 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.676348925 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.676357985 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.676381111 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.676413059 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.676429987 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.676438093 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.676616907 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.676625967 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.676711082 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.676718950 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.676743984 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.676749945 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.676768064 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.676783085 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.676798105 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.676831007 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.676853895 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.676907063 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.676922083 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.676983118 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.676991940 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.677046061 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.677053928 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.677090883 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.677155018 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.677162886 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.677196980 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.677229881 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.677251101 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.677270889 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.677304983 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.677314043 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.677340984 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.677393913 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.677402973 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.677452087 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.677489996 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.677577972 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.677587986 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.677607059 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.677654982 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.677664042 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.677689075 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.677798986 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.677808046 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.677831888 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.677900076 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.677906036 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.678000927 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.678018093 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.678026915 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.678049088 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.678064108 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.678141117 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.678180933 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.678189993 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.678273916 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.678309917 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.678334951 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.678433895 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.678441048 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.678536892 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.678569078 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.678617001 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.678626060 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.678649902 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.678771019 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.678776026 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.678778887 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.678884983 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.678894043 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.678916931 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.678944111 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.678980112 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.679018021 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.679028988 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.679048061 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.679068089 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.679104090 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.679151058 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.679160118 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.679214954 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.679224968 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.679250002 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.679279089 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.679289103 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.679300070 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.679395914 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.679424047 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.679480076 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.679518938 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.679554939 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.679578066 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.679606915 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.679650068 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.679692984 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.679702044 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.679712057 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.679728985 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.679745913 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.679778099 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.679780006 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.679832935 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.679867983 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.791565895 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.791582108 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.791667938 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.791678905 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.791687965 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.791699886 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.791742086 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.791745901 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.791753054 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.791785002 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.791860104 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.791870117 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.791901112 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.791915894 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.791922092 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.791953087 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.791984081 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.792120934 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.792201042 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.792253971 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.792265892 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.792274952 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.792320967 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.792426109 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.792435884 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.792447090 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.792493105 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.792510033 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.792545080 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.792594910 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.792603970 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.792644024 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.792691946 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.792727947 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.792735100 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.792782068 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.792859077 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.792874098 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.792902946 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.792947054 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.792953968 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.792989016 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.792999029 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.793010950 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.793028116 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.793060064 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.793066025 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.793186903 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.793236971 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.793298006 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.793317080 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.793348074 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.793359995 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.793392897 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.793400049 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.793457985 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.793508053 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.793541908 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.793560028 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.793602943 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.793641090 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.793649912 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.793698072 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.793715954 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.793756962 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.793804884 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.793863058 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.793873072 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.793912888 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.793955088 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.793965101 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.794006109 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.794040918 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.794049978 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.794086933 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.794173956 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.794183969 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.794190884 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.794199944 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.794224977 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.794239998 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.794250965 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.794258118 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.794323921 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.794363022 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.794404984 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.794476032 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.794550896 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.794584036 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.794625044 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.794691086 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.794698954 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.794742107 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.794778109 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.794786930 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.794836044 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.794884920 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.794930935 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.794950008 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.795031071 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.795073032 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.795084953 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.795121908 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.795125961 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.795151949 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.795171976 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.795202017 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.795376062 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.795391083 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.795424938 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.795439959 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.795536995 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.795546055 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.795589924 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.795598030 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.795631886 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.795651913 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.795694113 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.795732975 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.795777082 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.795788050 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.795911074 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.795922995 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.795967102 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.796008110 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.796025991 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.796052933 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.796065092 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.796113968 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.796124935 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.796168089 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.796194077 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.796228886 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.796277046 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.796355963 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.796365023 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.796410084 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.796487093 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.796520948 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.796565056 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.796612024 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.796622038 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.796658039 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.796686888 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.796751022 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.796793938 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.796814919 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.796824932 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.796864986 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.796884060 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.796896935 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.796946049 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.797019005 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.797030926 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.797068119 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.797079086 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.797111034 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.797122002 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.797168016 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.797214031 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.797224998 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.797261000 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.797317982 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.797328949 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.797373056 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.797405005 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.797435045 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.797478914 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.797525883 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.797539949 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.797553062 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.797581911 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.797594070 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.797707081 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.797718048 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.797739983 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.797753096 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.797763109 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.797800064 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.797832012 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.797861099 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.797909021 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.797947884 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.797959089 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.797997952 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.798039913 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.798067093 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.798115969 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.798166037 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.798176050 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.798221111 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.798254967 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.798300982 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.798346043 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.798358917 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.798369884 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.798415899 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.798420906 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.798490047 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.798501015 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.798532009 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.798542976 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.798553944 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.798600912 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.798614025 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.798646927 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.798660994 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.798700094 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.798731089 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.798772097 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.798796892 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.798830032 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.798872948 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.798899889 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.798943043 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.798988104 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.799036980 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.799048901 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.799088955 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.799110889 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.799138069 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.799190998 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.799216032 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.799299002 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.799350023 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.799350023 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.799360991 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.799401045 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.799448967 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.799458981 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.799505949 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.799509048 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.799544096 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.799587965 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.799588919 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.799602032 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.799634933 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.799647093 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.799680948 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.799683094 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.799777031 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.799787045 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.799823046 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.799835920 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.799860954 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.799871922 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.799906015 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.799930096 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.800009966 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.800029039 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.800050974 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.800081015 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.800160885 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.800172091 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.800183058 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.800193071 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.800203085 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.800246954 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.800340891 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.800354004 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.800380945 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.800390959 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.800400972 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.800409079 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.800435066 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.800450087 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.800463915 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.800504923 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.800532103 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.800558090 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.800579071 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.800681114 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.800724983 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.800745964 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.800757885 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.800767899 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.800796986 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.800800085 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.800810099 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.800811052 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.800854921 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.800857067 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.800899029 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.800951004 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.800972939 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.800996065 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801043987 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.801073074 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801117897 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801127911 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801167965 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.801194906 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.801253080 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801270008 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801280975 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801290035 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801332951 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.801383018 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801393986 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801403999 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801414013 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801433086 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.801445961 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.801465034 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.801503897 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801515102 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801525116 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801536083 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801542044 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801558971 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.801592112 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.801714897 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801727057 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801736116 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801745892 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801755905 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801764011 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.801765919 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801775932 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801776886 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.801786900 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801796913 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.801808119 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801827908 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801829100 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.801837921 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801860094 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.801876068 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.801887989 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801933050 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.801942110 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.801985979 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.802023888 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.802030087 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.802083969 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.802117109 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.802128077 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.802174091 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.802181959 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.802227020 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.802270889 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.802371025 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.802381992 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.802395105 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.802427053 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.802428007 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.802449942 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.802476883 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.802556038 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.802567005 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.802606106 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.802613020 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.802617073 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.802661896 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.802814960 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.802825928 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.802835941 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.802845001 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.802867889 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.802887917 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.802937984 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.802948952 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.802958965 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.802968979 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.802978992 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.802990913 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.803009033 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.803021908 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.803024054 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.803033113 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.803042889 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.803076982 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.803153038 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.803164005 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.803173065 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.803183079 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.803204060 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.803216934 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.803225040 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.803293943 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.803318977 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.803329945 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.803340912 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.803364992 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.803379059 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.803474903 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.803486109 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.803495884 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.803505898 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.803518057 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.803527117 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.803527117 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.803536892 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.803543091 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.803559065 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.803580999 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.809938908 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.809973001 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.809987068 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.810034990 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.810051918 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.810086966 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.810112000 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.810123920 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.810357094 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.911617041 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.911655903 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.911691904 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.911703110 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.911732912 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.911781073 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.911788940 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.911791086 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.911832094 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.911839008 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.911840916 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.911883116 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.911952019 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.911973953 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.911983967 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.912002087 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.912022114 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.912072897 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.912081957 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.912127018 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.912149906 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.912198067 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.912210941 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.912220955 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.912271976 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.912286043 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.912296057 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.912338018 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.912398100 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.912408113 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.912455082 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.912478924 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.912528992 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.912580013 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.912590027 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.912599087 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.912610054 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.912637949 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.912650108 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.912658930 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.912704945 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.912779093 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.912787914 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.912834883 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.912842989 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.912852049 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.912892103 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.912966967 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.912997007 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.913006067 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.913016081 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.913021088 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.913049936 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.913067102 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.913084984 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.913115025 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.913126945 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.913162947 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.913253069 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.913274050 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.913319111 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.913327932 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.913372040 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.913378954 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.913410902 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.913456917 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.913463116 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.913490057 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.913505077 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.913520098 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.913538933 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.913557053 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.913652897 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.913688898 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.913734913 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.913774967 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.913801908 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.913826942 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.913842916 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.913980007 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.914021969 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.914030075 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.914139032 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.914174080 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.914184093 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.914221048 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.914298058 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.914334059 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.914340973 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.914410114 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.914426088 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.914488077 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.914505959 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.914551020 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.914552927 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.914562941 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.914617062 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.914645910 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.914654970 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.914689064 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.914697886 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.914730072 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.914733887 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.914784908 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.914838076 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.914848089 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.914889097 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.914941072 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.914974928 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.915020943 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.915031910 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.915050983 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.915071011 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.915102005 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.915133953 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.915143967 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.915182114 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.915190935 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.915219069 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.915241003 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.915257931 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.915293932 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.915302992 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.915352106 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.915390015 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.915400028 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.915457010 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.915463924 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.915473938 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.915524006 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.915532112 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.915541887 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.915581942 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.915699005 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.915709019 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.915731907 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.915740967 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.915752888 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.915757895 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.915785074 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.915795088 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.915812969 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.915832043 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.915868044 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.915889978 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.915918112 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.915930033 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.915941000 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.915961027 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.916018009 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.916045904 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.916091919 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.916140079 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.916141033 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.916151047 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.916191101 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.916227102 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.916269064 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.916297913 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.916318893 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.916333914 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.916333914 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.916358948 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.916374922 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.916433096 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.916476965 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.916527033 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.916609049 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.916620016 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.916652918 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.916665077 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.916678905 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.916687965 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.916723013 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.916729927 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.916749001 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.916766882 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.916774988 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.916799068 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.916819096 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.916829109 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.916877031 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.916904926 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.916934013 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.916944981 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.917000055 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.917000055 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.917041063 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.917053938 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.917064905 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.917109013 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.917145967 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.917155027 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.917164087 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.917208910 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.917244911 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.917263031 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.917284966 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.917285919 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.917304039 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.917327881 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.917423010 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.917464972 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.917500019 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.917519093 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.917628050 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.917717934 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.917754889 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.917768955 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.917803049 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.917809010 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.917829990 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.917841911 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.917848110 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.917877913 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.917973042 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.918010950 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.918035030 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.918061972 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.918061972 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.918072939 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.918118000 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.918201923 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.918255091 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.918266058 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.918276072 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.918304920 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.918314934 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.918320894 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.918361902 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.918411970 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.918454885 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.918504000 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.918505907 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.918525934 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.918570042 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.918730021 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.918775082 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.918773890 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.918818951 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.918843031 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.918939114 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.918983936 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.919025898 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.919065952 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.919076920 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.919142008 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.919167042 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.919210911 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.919215918 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.919255018 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.919292927 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.919318914 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.919332981 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.919358015 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.919368029 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.919373035 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.919404030 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.919445038 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.919476986 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.919497013 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.919527054 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.919568062 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.919672012 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.919714928 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.919732094 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.919775009 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.919910908 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.919960976 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.919967890 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.920047998 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.920088053 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.920099020 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.920141935 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.920201063 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.920209885 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.920259953 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.920299053 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.920312881 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.920346022 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.920355082 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.920357943 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.920372009 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.920408010 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.920423031 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.920499086 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.920509100 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.920519114 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.920545101 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.920553923 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.920573950 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.920593977 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.920608997 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.920635939 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.920654058 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.920656919 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.920681000 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.920702934 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.920706987 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.920753956 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.920767069 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.920806885 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.920820951 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.920834064 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.920845032 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.920891047 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.920933008 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.920953989 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.920973063 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.920989037 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.920995951 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.921015978 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.921034098 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.921058893 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.921149969 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.921183109 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.921200991 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.921228886 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.921261072 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.921271086 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.921299934 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.921312094 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.921314955 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.921343088 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.921363115 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.921379089 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.921399117 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.921444893 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.921479940 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.921525002 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.921574116 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.921616077 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.921667099 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.921689034 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.921747923 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.921756029 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.921781063 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.921797991 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.921819925 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.921824932 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.921854973 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.921885014 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.921915054 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.921916962 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.921967030 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.921979904 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.922089100 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.922099113 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.922137976 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.922216892 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.922254086 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.922259092 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.922301054 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.922324896 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.922344923 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.922389030 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.922405958 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.922427893 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.922473907 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.922765970 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.922775984 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.922806978 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.922822952 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.923085928 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.923095942 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.923140049 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.923186064 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.923196077 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.923224926 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.923230886 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.923233986 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.923244953 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.923254013 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.923270941 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.923302889 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.923327923 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.923358917 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.923382998 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.923427105 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.923437119 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.923460960 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.923497915 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.923523903 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.923532963 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.923573971 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.923616886 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.923626900 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.923667908 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.923692942 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.923701048 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.923736095 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.923784018 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.923784018 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.923820019 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.923824072 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.923892021 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.923923969 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.923933983 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.923965931 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.923981905 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.924010992 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.924030066 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.924051046 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.924060106 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.924062014 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.924099922 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.924122095 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.924190998 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.924201012 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.924210072 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.924240112 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.924257040 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.924264908 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.924276114 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.924284935 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.924314022 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.924338102 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.924345970 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.924355030 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.924364090 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.924371958 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.924401999 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.924422979 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.924489021 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.924499035 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.924508095 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.924534082 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.924535990 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.924552917 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.924576044 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.924654007 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.924663067 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.924712896 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.924783945 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.924827099 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.924839973 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.924901009 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.924911022 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.924921989 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.924961090 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.924982071 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.925036907 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.925045967 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.925062895 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.925091982 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.925092936 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.925101995 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.925137997 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.925152063 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.925177097 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.925223112 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.925266027 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.925275087 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.925321102 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.925348997 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.925369024 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.925399065 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.925415039 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.925457001 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.925498962 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.925504923 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.925518036 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.925538063 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.925564051 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.925645113 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.925678015 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.925784111 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.925831079 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.925879955 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.925906897 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.925956964 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.926121950 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.926175117 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.926196098 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.926244974 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.926254034 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.926352024 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.926388979 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.926405907 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.926426888 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.926479101 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.926501989 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.926532030 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.926553965 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.926585913 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.926609039 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.926618099 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.926625967 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.926635027 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.926661015 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.926682949 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.926691055 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.926732063 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.926743031 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.926789045 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.926825047 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.926862955 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.926886082 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.926915884 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.926975965 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.927045107 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.927062988 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.927081108 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.927107096 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.927160978 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.927217007 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.927261114 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.927273035 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.927309990 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.927345991 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.927366018 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.927417040 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.927421093 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.927462101 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.927505016 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.927604914 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.927630901 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.927658081 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.927736998 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.927793980 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.927814960 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.927860975 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.927885056 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.927931070 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.927963972 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.928006887 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.928049088 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.928100109 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.928102016 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.928143024 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.928169966 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.928217888 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.928260088 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.928344011 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.928347111 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.928467989 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.928477049 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.928524017 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.974045038 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:06.974225998 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.974297047 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.974342108 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.974401951 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:06.974442959 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.068203926 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.070338011 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.070411921 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.070451021 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.070504904 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.070542097 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.070589066 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.070626020 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.070671082 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.070705891 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.070744991 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.070785999 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.070837021 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.070889950 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.070949078 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.070991039 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.071050882 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.071089029 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.071155071 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.071197033 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.071255922 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.071295023 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.071358919 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.071382999 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.094597101 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.097548008 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.138021946 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.142060995 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.142127991 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.142178059 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.142229080 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.142278910 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.142327070 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.210436106 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.211415052 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.211543083 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.211605072 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.211664915 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.211719990 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.211769104 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.211812973 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.211859941 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.211899996 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.211947918 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.211987972 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.212044954 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.212086916 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.212146997 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.212189913 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.212243080 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.212287903 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.212353945 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.212398052 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.212454081 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.212497950 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.212549925 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.212579012 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.217716932 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.217801094 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.258065939 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.258270979 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.307815075 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.309910059 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.309981108 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.310030937 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.310086012 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.310137033 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.310200930 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.335859060 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.335871935 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.336009979 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.336019039 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.336067915 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.336117983 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.336127996 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.336129904 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.336137056 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.336185932 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.336249113 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.336298943 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.336301088 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.336368084 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.336390018 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.336453915 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.336463928 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.336472988 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.336529016 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.336622953 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.336754084 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.336762905 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.336771011 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.336792946 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.336826086 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.336886883 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.336896896 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.336900949 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.336946964 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.337012053 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.337021112 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.337060928 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.337280989 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.337291956 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.337335110 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.337408066 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.337418079 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.337425947 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.337476969 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.337557077 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.337699890 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.337709904 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.337719917 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.337728024 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.337743044 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.337779999 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.337820053 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.337829113 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.337867975 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.337976933 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.337985992 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.338030100 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.338263988 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.338274002 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.338280916 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.338320971 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.338462114 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.338470936 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.338478088 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.338486910 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.338510036 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.338536024 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.338537931 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.338546038 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.338555098 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.338562965 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.338570118 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.338586092 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.338628054 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.338985920 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.338995934 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.339004040 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.339015007 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.339025021 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.339032888 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.339040995 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.339044094 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.339049101 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.339057922 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.339066029 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.339066982 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.339076042 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.339083910 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.339092970 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.339093924 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.339102983 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.339107990 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.339123011 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.339131117 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.339138985 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.339147091 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.339153051 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.339169025 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.339200020 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.339236975 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.339253902 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.339303017 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.339404106 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.339802027 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.339854002 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.340629101 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.340637922 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.340646982 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.340682983 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.340702057 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.340764046 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.340773106 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.340780020 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.340787888 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.340814114 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.340831995 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.340907097 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.340915918 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.340924978 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.340933084 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.340940952 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.340949059 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.340954065 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.340970993 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.340998888 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.341026068 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341034889 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341042042 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341049910 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341053963 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341072083 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.341100931 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.341159105 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341167927 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341176033 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341183901 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341192961 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341202974 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.341238022 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.341308117 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341316938 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341324091 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341363907 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.341413021 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341423035 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341429949 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341439009 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341464043 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.341489077 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.341607094 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341615915 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341662884 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.341888905 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341898918 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341907024 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341916084 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341924906 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341933012 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341942072 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341948032 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.341950893 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341962099 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.341969013 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341978073 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341984987 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.341989040 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.341993093 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.342003107 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.342004061 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.342011929 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.342020988 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.342029095 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.342034101 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.342037916 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.342046022 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.342046976 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.342055082 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.342063904 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.342071056 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.342078924 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.342080116 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.342089891 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.342098951 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.342130899 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.342271090 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.342281103 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.342288017 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.342295885 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.342303991 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.342323065 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.342355013 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.342356920 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.342365980 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.342374086 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.342380047 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.342396975 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.342397928 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.342406988 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.342423916 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.342434883 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.342461109 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.378933907 CET	15666	49699	45.130.145.152	192.168.2.7
Nov 29, 2024 16:07:07.380007029 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.380079031 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.380137920 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.380184889 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.380223989 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.380268097 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.380306005 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.380354881 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.380398989 CET	49699	15666	192.168.2.7	45.130.145.152
Nov 29, 2024 16:07:07.380464077 CET	49699	15666	192.168.2.7	45.130.145.152

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 29, 2024 16:07:00.117027044 CET	192.168.2.7	1.1.1.1	0xee49	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 29, 2024 16:07:00.260934114 CET	1.1.1.1	192.168.2.7	0xee49	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Nov 29, 2024 16:07:00.260934114 CET	1.1.1.1	192.168.2.7	0xee49	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Nov 29, 2024 16:07:00.260934114 CET	1.1.1.1	192.168.2.7	0xee49	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	172.67.74.152	443	7344	C:\Users\user\Desktop\unique.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 15:07:01 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2024-11-29 15:07:02 UTC	425	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 15:07:02 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8ea38149887d726e-EWR server-timing: cfL4;desc="?proto=TCP&rtt=3700&min_rtt=1853&rtt_var=1986&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2820&recv_bytes=738&delivery_rate=1575822&cwnd=221&unsent_bytes=0&cid=fdb154a811312bb6&ts=695&x=0"
2024-11-29 15:07:02 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38 Data Ascii: 8.46.123.228

Target ID:	0
Start time:	10:06:59
Start date:	29/11/2024
Path:	C:\Users\user\Desktop\unique.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\unique.exe"
Imagebase:	0x7ff617e60000
File size:	3'341'824 bytes
MD5 hash:	814A59368670F8D35AD8EB71AB874666
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000000.00000002.1491224091.000001EF1F070000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	91.1%
Signature Coverage:	20.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	88

Executed Functions

Function 000001EF1F21FB30 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 225
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 000001EF1F21FB71
GetSystemMetrics.USER32 ref: 000001EF1F21FB7F
GetSystemMetrics.USER32 ref: 000001EF1F21FB8D
GetSystemMetrics.USER32 ref: 000001EF1F21FB9B
GetDC.USER32 ref: 000001EF1F21FBA5
GetDeviceCaps.GDI32 ref: 000001EF1F21FBBB
GetDeviceCaps.GDI32 ref: 000001EF1F21FBCB
CreateCompatibleDC.GDI32 ref: 000001EF1F21FBD8
CreateCompatibleBitmap.GDI32 ref: 000001EF1F21FBF0
SelectObject.GDI32 ref: 000001EF1F21FC06
BitBlt.GDI32 ref: 000001EF1F21FC3C
SHCreateMemStream.SHLWAPI ref: 000001EF1F21FC72
SelectObject.GDI32 ref: 000001EF1F21FC88
DeleteDC.GDI32 ref: 000001EF1F21FC91
ReleaseDC.USER32 ref: 000001EF1F21FC9C
DeleteObject.GDI32 ref: 000001EF1F21FCA5
EnterCriticalSection.KERNEL32 ref: 000001EF1F21FD9C
LeaveCriticalSection.KERNEL32 ref: 000001EF1F21FDAE
IStream_Size.SHLWAPI ref: 000001EF1F21FDE5
IStream_Reset.SHLWAPI ref: 000001EF1F21FDF6
IStream_Read.SHLWAPI ref: 000001EF1F21FE7B
SelectObject.GDI32 ref: 000001EF1F21FED5
DeleteDC.GDI32 ref: 000001EF1F21FEDE
ReleaseDC.USER32 ref: 000001EF1F21FEEB
DeleteObject.GDI32 ref: 000001EF1F21FEF4

Strings

, xrefs: 000001EF1F21FC11

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Object$DeleteMetricsSystem$CreateSelectStream_$CapsCompatibleCriticalDeviceReleaseSection$BitmapEnterLeaveReadResetSizeStream
String ID:
API String ID: 3214587331-3916222277
Opcode ID: e8e9b911cd9b9f557c011d0a693391b94df579aa06795856880fde4b09ecdcd5
Instruction ID: cf79a5d2d06bf636c98b8bd750f278b3069d8099b6a9c0f48313e4842629aeb4
Opcode Fuzzy Hash: e8e9b911cd9b9f557c011d0a693391b94df579aa06795856880fde4b09ecdcd5
Instruction Fuzzy Hash: 26B13173618BC4C6E764DB21E8547DEB3A5FBAAB80F404629DE9943B55DF38C086CB01

Function 000001EF1F2598C0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32 ref: 000001EF1F25996D
GetLastError.KERNEL32 ref: 000001EF1F259977
FindFirstFileW.KERNEL32 ref: 000001EF1F25998E
GetLastError.KERNEL32 ref: 000001EF1F25999A
FindClose.KERNEL32 ref: 000001EF1F2599A8
__std_fs_open_handle.LIBCPMT ref: 000001EF1F259A3B
CloseHandle.KERNEL32 ref: 000001EF1F259A51
CloseHandle.KERNEL32 ref: 000001EF1F259BC4

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: 9b9cafa6476ba7d57e6375b49b2d31870033937920a690a77e8b0d8031f3f21f
Instruction ID: 25d6908ea74a0ee20ce090144d1f8f9f681d3a9ce64d9482510d6cde4a9a6b4a
Opcode Fuzzy Hash: 9b9cafa6476ba7d57e6375b49b2d31870033937920a690a77e8b0d8031f3f21f
Instruction Fuzzy Hash: 80914D33314AC9C6FA648F25E4547DD3391AFA77B0F1447389EB6476E5DA38C8828A02

Function 000001EF1F221660 Relevance: 26.6, APIs: 4, Strings: 10, Instructions: 2133timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 000001EF1F221990

Strings

system, xrefs: 000001EF1F2223E4, 000001EF1F2224D3, 000001EF1F2225C9, 000001EF1F2226C3, 000001EF1F22280B, 000001EF1F222905, 000001EF1F2229F8, 000001EF1F222B7F, 000001EF1F222D70, 000001EF1F222FF1, 000001EF1F2231B4, 000001EF1F2233CE, 000001EF1F22356D, 000001EF1F223717, 000001EF1F2237DD
timezone, xrefs: 000001EF1F223414
[UTC, xrefs: 000001EF1F221963
time, xrefs: 000001EF1F223041
computer_name, xrefs: 000001EF1F222954
gpu, xrefs: 000001EF1F222522
user_name, xrefs: 000001EF1F22242F
%d-%m-%Y, %H:%M:%S, xrefs: 000001EF1F222F5F
ram, xrefs: 000001EF1F22285B
cpu, xrefs: 000001EF1F222618

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: %d-%m-%Y, %H:%M:%S$[UTC$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 565725191-1610854563
Opcode ID: 1fe095e091ca18269d05a5b9bd0bb51583a8f5c1e491c85e2abcf543d409da54
Instruction ID: 7f91c901ff5a8f2eea0641c947e00e37a3ff22104014ad6c9e57b8517aa51429
Opcode Fuzzy Hash: 1fe095e091ca18269d05a5b9bd0bb51583a8f5c1e491c85e2abcf543d409da54
Instruction Fuzzy Hash: BF238F33614BC485EB21CF24E8503DD77A1FBA9798F505229EEAD57B9ADB78C281C700

Function 000001EF1F221FF0 Relevance: 22.5, APIs: 3, Strings: 9, Instructions: 1516COMMON

Download Yara Rule

APIs

Part of subcall function 000001EF1F220C30: GetCurrentHwProfileW.ADVAPI32 ref: 000001EF1F220C6C

Part of subcall function 000001EF1F220500: EnumDisplayDevicesW.USER32 ref: 000001EF1F220617
Part of subcall function 000001EF1F220500: EnumDisplayDevicesW.USER32 ref: 000001EF1F2206BB

Part of subcall function 000001EF1F220420: RegGetValueA.ADVAPI32 ref: 000001EF1F220489

Part of subcall function 000001EF1F220110: GetUserNameW.ADVAPI32 ref: 000001EF1F220155

Part of subcall function 000001EF1F2201B0: GetComputerNameW.KERNEL32 ref: 000001EF1F2201F5

GlobalMemoryStatusEx.KERNEL32 ref: 000001EF1F22277C
wcsftime.LIBCMT ref: 000001EF1F222F72
GetModuleFileNameA.KERNEL32 ref: 000001EF1F223106

Strings

system, xrefs: 000001EF1F2223E4, 000001EF1F2224D3, 000001EF1F2225C9, 000001EF1F2226C3, 000001EF1F22280B, 000001EF1F222905, 000001EF1F2229F8, 000001EF1F222B7F, 000001EF1F222D70, 000001EF1F222FF1, 000001EF1F2231B4, 000001EF1F2233CE, 000001EF1F22356D, 000001EF1F223717, 000001EF1F2237DD
timezone, xrefs: 000001EF1F223414
time, xrefs: 000001EF1F223041
computer_name, xrefs: 000001EF1F222954
gpu, xrefs: 000001EF1F222522
user_name, xrefs: 000001EF1F22242F
%d-%m-%Y, %H:%M:%S, xrefs: 000001EF1F222F5F
ram, xrefs: 000001EF1F22285B
cpu, xrefs: 000001EF1F222618

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Name$DevicesDisplayEnum$ComputerCurrentFileGlobalMemoryModuleProfileStatusUserValuewcsftime
String ID: %d-%m-%Y, %H:%M:%S$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 2509368203-1182675529
Opcode ID: 6c01c5b4889c0ced54e0e8f157e212984f9dff6cfe7159bfa7e664528e928200
Instruction ID: 71cfed05e515e4dd2e7c2119c2544797803f366a3c08cab9865f2742864088fa
Opcode Fuzzy Hash: 6c01c5b4889c0ced54e0e8f157e212984f9dff6cfe7159bfa7e664528e928200
Instruction Fuzzy Hash: 75F26D33614BC489DB21CF24E8503DD77A1FBA9798F409229EE9D57BA9DB78C681C700

Function 000001EF1F1DB820 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 862
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000001EF1F1DB90C
GetProcAddress.KERNEL32 ref: 000001EF1F1DBA17
GetProcAddress.KERNEL32 ref: 000001EF1F1DBAD9
GetProcAddress.KERNEL32 ref: 000001EF1F1DBB53
GetProcAddress.KERNEL32 ref: 000001EF1F1DBBD5
GetProcAddress.KERNEL32 ref: 000001EF1F1DBC4F
GetProcAddress.KERNEL32 ref: 000001EF1F1DBCD3
FreeLibrary.KERNEL32 ref: 000001EF1F1DC801

Strings

system, xrefs: 000001EF1F1DC60D
cannot use push_back() with , xrefs: 000001EF1F1DC84F
vault, xrefs: 000001EF1F1DC663

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: cannot use push_back() with $system$vault
API String ID: 2449869053-1741236777
Opcode ID: a8895f8ee5662b26eb4cafeb8e2736f8212f0785648f1076f3dc1bff4ccec1b7
Instruction ID: 8e9664670b3715e5b7dd7424828b0ef88e0fd78594a9ca75fd3eeafb350b2b9a
Opcode Fuzzy Hash: a8895f8ee5662b26eb4cafeb8e2736f8212f0785648f1076f3dc1bff4ccec1b7
Instruction Fuzzy Hash: D4923833205BC889DB618F29E8843DD73A4FB99798F104229DE9D5BB99EF74C685C700

Function 000001EF1F216480 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001EF1F219760: GetCurrentProcess.KERNEL32 ref: 000001EF1F21979B
Part of subcall function 000001EF1F219760: OpenProcessToken.ADVAPI32 ref: 000001EF1F2197AE
Part of subcall function 000001EF1F219760: GetTokenInformation.ADVAPI32 ref: 000001EF1F2197EA

ExitProcess.KERNEL32 ref: 000001EF1F2164C7
OpenMutexA.KERNEL32 ref: 000001EF1F2165E2
ExitProcess.KERNEL32 ref: 000001EF1F2165F2
CreateMutexA.KERNEL32 ref: 000001EF1F216611
ExitProcess.KERNEL32 ref: 000001EF1F216637

Part of subcall function 000001EF1F219AA0: GetModuleFileNameW.KERNEL32 ref: 000001EF1F219AEA

Part of subcall function 000001EF1F224740: CoInitializeEx.OLE32 ref: 000001EF1F2247AA

Strings

SeImpersonatePrivilege, xrefs: 000001EF1F2164DA
SeDebugPrivilege, xrefs: 000001EF1F2164CE

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Process$Exit$MutexOpenToken$CreateCurrentFileInformationInitializeModuleName
String ID: SeDebugPrivilege$SeImpersonatePrivilege
API String ID: 470559343-3768118664
Opcode ID: f362d8e3b8d40b5d244b3b549658b0e81101f08c6b8f359de49cab7a4651f29d
Instruction ID: 2a7dc0e1d6b6e2e7d470e00284d1c82138470c3b3100be9e0d12763613b29d87
Opcode Fuzzy Hash: f362d8e3b8d40b5d244b3b549658b0e81101f08c6b8f359de49cab7a4651f29d
Instruction Fuzzy Hash: EB619673508AC8C1FA20A764E4553DE6360FFA5750F50463DEEAD82AD7DF28C0C78A16

Function 000001EF1F24114C Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 000001EF1F241191

Part of subcall function 000001EF1F2407F8: _invalid_parameter_noinfo.LIBCMT ref: 000001EF1F24080C

Part of subcall function 000001EF1F23B550: HeapFree.KERNEL32 ref: 000001EF1F23B566
Part of subcall function 000001EF1F23B550: GetLastError.KERNEL32 ref: 000001EF1F23B570

Part of subcall function 000001EF1F249D94: _invalid_parameter_noinfo.LIBCMT ref: 000001EF1F249CDF

_get_daylight.LIBCMT ref: 000001EF1F241180

Part of subcall function 000001EF1F240858: _invalid_parameter_noinfo.LIBCMT ref: 000001EF1F24086C

_get_daylight.LIBCMT ref: 000001EF1F2413F6
_get_daylight.LIBCMT ref: 000001EF1F241407
_get_daylight.LIBCMT ref: 000001EF1F241418
GetTimeZoneInformation.KERNEL32 ref: 000001EF1F24143F

Strings

Eastern Summer Time, xrefs: 000001EF1F2414FD
Eastern Standard Time, xrefs: 000001EF1F2414E5

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 355007559-239921721
Opcode ID: 81739166be4aa7f83f73f8b5c4c772bb7cbf832f5b2b22088efdd0610fe74ccd
Instruction ID: 00f0e386eb2160e3e526a11b996a9db8bfc0e2aa1ff62a670ad9ad31ee56573e
Opcode Fuzzy Hash: 81739166be4aa7f83f73f8b5c4c772bb7cbf832f5b2b22088efdd0610fe74ccd
Instruction Fuzzy Hash: EDD1BB377002D8C6E720EF26D4407ED77A1EB74B84F54813AAE6947A95DA78C8C38742

Function 000001EF1F21F200 Relevance: 13.9, APIs: 9, Instructions: 408
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 000001EF1F21F3CB
InternetOpenUrlA.WININET ref: 000001EF1F21F4A8
HttpQueryInfoW.WININET ref: 000001EF1F21F509
HttpQueryInfoW.WININET ref: 000001EF1F21F5A2
InternetQueryDataAvailable.WININET ref: 000001EF1F21F5E6
InternetReadFile.WININET ref: 000001EF1F21F6A9
InternetQueryDataAvailable.WININET ref: 000001EF1F21F774
InternetCloseHandle.WININET ref: 000001EF1F21F81E
Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F21F87B

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Internet$Query$AvailableDataHttpInfoOpen$CloseConcurrency::cancel_current_taskFileHandleRead
String ID:
API String ID: 1475545111-0
Opcode ID: a8fd5c2a05c31689c3ffe3aa40e597784d98751f13c577de619849379d124548
Instruction ID: 1a86592b459eb336e869a00da53d8e79138da294c3499244a66ea9ce5cd08c61
Opcode Fuzzy Hash: a8fd5c2a05c31689c3ffe3aa40e597784d98751f13c577de619849379d124548
Instruction Fuzzy Hash: C2025033A18BD8C5E710CB69E84079E77A5FBA5794F104229EEAC57B99DF78C082C701

Function 000001EF1F25E968 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001EF1F25E54C: _invalid_parameter_noinfo.LIBCMT ref: 000001EF1F25E58D
Part of subcall function 000001EF1F25E54C: _invalid_parameter_noinfo.LIBCMT ref: 000001EF1F25E60B
Part of subcall function 000001EF1F25E54C: _invalid_parameter_noinfo.LIBCMT ref: 000001EF1F25E65C

CreateFileW.KERNEL32 ref: 000001EF1F25EA6E
CreateFileW.KERNEL32 ref: 000001EF1F25EABE
GetLastError.KERNEL32 ref: 000001EF1F25EAEE
GetFileType.KERNEL32 ref: 000001EF1F25EB03
GetLastError.KERNEL32 ref: 000001EF1F25EB0D
CloseHandle.KERNEL32 ref: 000001EF1F25EB40
CloseHandle.KERNEL32 ref: 000001EF1F25ECA3
CreateFileW.KERNEL32 ref: 000001EF1F25ECD8
GetLastError.KERNEL32 ref: 000001EF1F25ECE7

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 484b9744f6cc28d441a3ba22cd2a9bb849a09fc1e06d845b9773f87c4c6ec638
Instruction ID: 52ad8fe43f2207e33b9987f3fdb4d4877ae583730ad4ad588340d6372a365cfa
Opcode Fuzzy Hash: 484b9744f6cc28d441a3ba22cd2a9bb849a09fc1e06d845b9773f87c4c6ec638
Instruction Fuzzy Hash: 36C19D37720AC8C6EB10CFA4C4916EC3761FB69BA8F015229DF6A977A5CB34C492C701

Function 000001EF1F218F60 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 451
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32 ref: 000001EF1F2191A1
SetFilePointer.KERNEL32 ref: 000001EF1F219254
ReadFile.KERNEL32 ref: 000001EF1F219283

Strings

ios_base::eofbit set, xrefs: 000001EF1F2196C4
ios_base::badbit set, xrefs: 000001EF1F2196B1, 000001EF1F21972F
exists, xrefs: 000001EF1F21970A
ios_base::failbit set, xrefs: 000001EF1F2196BD

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: File$PointerReadSize
String ID: exists$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 404940565-15404121
Opcode ID: 1155261fbd582eca2877628c12e7991cbb896ea92d8834a4a784601f3d110b66
Instruction ID: 03c08eb7e991266ad44b0a3f88b3ba5f93c1e318fdad68b4f310e19dea1c65b3
Opcode Fuzzy Hash: 1155261fbd582eca2877628c12e7991cbb896ea92d8834a4a784601f3d110b66
Instruction Fuzzy Hash: F5320533614BC8C9EB20CF24D8903DD37A1FBA5748F54822ADE5D97A99EB74C686C701

Function 000001EF1F2413C8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 000001EF1F2413F6

Part of subcall function 000001EF1F240858: _invalid_parameter_noinfo.LIBCMT ref: 000001EF1F24086C

_get_daylight.LIBCMT ref: 000001EF1F241407

Part of subcall function 000001EF1F2407F8: _invalid_parameter_noinfo.LIBCMT ref: 000001EF1F24080C

_get_daylight.LIBCMT ref: 000001EF1F241418

Part of subcall function 000001EF1F240828: _invalid_parameter_noinfo.LIBCMT ref: 000001EF1F24083C

Part of subcall function 000001EF1F23B550: HeapFree.KERNEL32 ref: 000001EF1F23B566
Part of subcall function 000001EF1F23B550: GetLastError.KERNEL32 ref: 000001EF1F23B570

GetTimeZoneInformation.KERNEL32 ref: 000001EF1F24143F

Strings

Eastern Summer Time, xrefs: 000001EF1F2414FD
Eastern Standard Time, xrefs: 000001EF1F2414E5

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 8c7917a29c397fa3200ed5a7405142a85cef7c6524de68c4b18d81a385570565
Instruction ID: 834384f64b61a60f5da5eb44784598ef2909bbe4c2a37bda54140e1faf814845
Opcode Fuzzy Hash: 8c7917a29c397fa3200ed5a7405142a85cef7c6524de68c4b18d81a385570565
Instruction Fuzzy Hash: 8D517A337006C8C6E710DF25E8816DD77A0FB78784F54413EAE6947AA6DB78C8828B42

Function 000001EF1F23749C Relevance: 9.2, APIs: 6, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F2374BE
_get_daylight.LIBCMT ref: 000001EF1F23751E
_get_daylight.LIBCMT ref: 000001EF1F23752F
_get_daylight.LIBCMT ref: 000001EF1F237540
_isindst.LIBCMT ref: 000001EF1F237591
_isindst.LIBCMT ref: 000001EF1F2375E4

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: _get_daylight$_isindst$_invalid_parameter_noinfo
String ID:
API String ID: 1405656091-0
Opcode ID: 842d06e59cb7d0c874962108e89d6781c57040cb1ba9c53ec58eb2fa30030a5a
Instruction ID: db088179bdd6d643de3ac14e9e5f70594fb3a02e20f78cdac37c09b81c3b2d54
Opcode Fuzzy Hash: 842d06e59cb7d0c874962108e89d6781c57040cb1ba9c53ec58eb2fa30030a5a
Instruction Fuzzy Hash: B381A7F37042C9CBEB588F25C9513EC77A5EB68788F04913DDE194A785EB38D5828741

Function 000001EF1F228B70 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 000001EF1F228D24
__std_exception_destroy.LIBVCRUNTIME ref: 000001EF1F228D32
__std_exception_destroy.LIBVCRUNTIME ref: 000001EF1F228FB5
__std_exception_destroy.LIBVCRUNTIME ref: 000001EF1F228FC3

Strings

value, xrefs: 000001EF1F228C4A, 000001EF1F228EE3

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: 4de1543864837dac50646e154f92d6689d7275dc2861293a9144eb5aa3cd25cf
Instruction ID: 9216b3d8d5507844dd4289491caf3163b4ae2a3e9d0fb4e92ad7f79fc778e513
Opcode Fuzzy Hash: 4de1543864837dac50646e154f92d6689d7275dc2861293a9144eb5aa3cd25cf
Instruction Fuzzy Hash: 35029E33614BC8C5EB00CB79D4843DD6761EBA57A4F50522AFEAE42ADADF68C1C6C701

Function 000001EF1F1DC8C0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 328processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000001EF1F1DC90A
Process32FirstW.KERNEL32 ref: 000001EF1F1DC94C
Process32NextW.KERNEL32 ref: 000001EF1F1DCB43
CloseHandle.KERNEL32 ref: 000001EF1F1DCDBA

Strings

[PID: , xrefs: 000001EF1F1DC98E

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 420147892-2210602247
Opcode ID: 14b2d3b6a66368e226afe159713d3a60639ca9888d2490b22d3054de2e5a24a7
Instruction ID: fb3b6f409e175522d06dfbc8a4e45b1b357dd6d9bb2fc4f0207585099b28a791
Opcode Fuzzy Hash: 14b2d3b6a66368e226afe159713d3a60639ca9888d2490b22d3054de2e5a24a7
Instruction Fuzzy Hash: 19E1B273614BC485EB20CB25E8843DD67A5F7A97A4F504629EE9D17B9ADF38C282C700

Function 000001EF1F225970 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000001EF1F2259BE
OpenProcessToken.ADVAPI32 ref: 000001EF1F2259D1
LookupPrivilegeValueW.ADVAPI32 ref: 000001EF1F2259F2
AdjustTokenPrivileges.ADVAPI32 ref: 000001EF1F225A38
CloseHandle.KERNEL32 ref: 000001EF1F225A58

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3038321057-0
Opcode ID: 29a02e95aae9899e0029659e102052f54fff5397b51cb33b914b83ea41570e5f
Instruction ID: 919975c62d43eb4ff5d3d1d40975fcd50f4ace6fbc436a0d9d9c5f0635ec830b
Opcode Fuzzy Hash: 29a02e95aae9899e0029659e102052f54fff5397b51cb33b914b83ea41570e5f
Instruction Fuzzy Hash: 9E216F32218BC4C6E7608B51F45538EB3A0FB99B90F558139EE9A47B58DF7CC586CB40

Function 000001EF1F201340 Relevance: 6.8, Strings: 5, Instructions: 599COMMON

Download Yara Rule

Strings

exists, xrefs: 000001EF1F20374D
status, xrefs: 000001EF1F2020D1, 000001EF1F2020F3, 000001EF1F20211B, 000001EF1F202143
cannot use push_back() with , xrefs: 000001EF1F202095
directory_iterator::directory_iterator, xrefs: 000001EF1F2020E3, 000001EF1F203764
prefs.js, xrefs: 000001EF1F2028A2

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID: cannot use push_back() with $directory_iterator::directory_iterator$exists$prefs.js$status
API String ID: 0-2713369562
Opcode ID: 53790456a874fa8d934425cf399f2cc19141f737087bb70a23a5d81461913800
Instruction ID: ab6c8e3ad2baa54d614c4a2a80fe94df3dc581f6b40856ae707290047c784c95
Opcode Fuzzy Hash: 53790456a874fa8d934425cf399f2cc19141f737087bb70a23a5d81461913800
Instruction Fuzzy Hash: 71520433609FC884E6B19B15E8813DEB3A4FB99784F50522ADEDC52B59EF78C195CB00

Function 000001EF1F1DACC0 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 671COMMON

Download Yara Rule

APIs

CredEnumerateA.ADVAPI32 ref: 000001EF1F1DAD22
CredFree.ADVAPI32 ref: 000001EF1F1DB746

Strings

cannot use push_back() with , xrefs: 000001EF1F1DB794

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Cred$EnumerateFree
String ID: cannot use push_back() with
API String ID: 3403564193-4122110429
Opcode ID: 78d1baae23a78e78b123628c26e2bfc16b87e4e7df7f4aaeddd4b720fddcf75b
Instruction ID: a9a779d86573ffe7af89537ed57f13538b8e6dd0248501c99e3942c0005aad2c
Opcode Fuzzy Hash: 78d1baae23a78e78b123628c26e2bfc16b87e4e7df7f4aaeddd4b720fddcf75b
Instruction Fuzzy Hash: 7D626B33614BC889EB20CF25E8943DD77A1F799798F504229EEAD17B99DB78C285C700

Function 000001EF1F22C55A Relevance: 5.6, Strings: 4, Instructions: 566COMMON

Download Yara Rule

Strings

object, xrefs: 000001EF1F22CD39
array, xrefs: 000001EF1F22CC84
object key, xrefs: 000001EF1F22CB5C, 000001EF1F22CEA3
object separator, xrefs: 000001EF1F22CAB3, 000001EF1F22CDEE

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID: array$object$object key$object separator
API String ID: 0-2277530871
Opcode ID: d3ec8f3c87a8cefc780fc128593a1fbd9028268d58b26d19438fcc692d430b3e
Instruction ID: 75ab610d409191b33e810e05bc92a9329094ea9cbfffa16a77d03e69bdf8b648
Opcode Fuzzy Hash: d3ec8f3c87a8cefc780fc128593a1fbd9028268d58b26d19438fcc692d430b3e
Instruction Fuzzy Hash: 0342E073610AC8D6EB10DF74C4513ED2361FBA5794F80222AEE5D97A9ADF74C286C342

Function 00007FF617E634C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 00007FF617E63527
NtProtectVirtualMemory.NTDLL ref: 00007FF617E63591

Strings

0, xrefs: 00007FF617E63507

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID: MemoryVirtual$ProtectQuery
String ID: 0
API String ID: 1355999870-4108050209
Opcode ID: 89413ede3b1e85be20c8f272e65a27b8bfe40e2a2e38e4141ba162e5d23f76ce
Instruction ID: 1959cccd4fea658946f26227c0a0b3379998833e50531e435f0c666b9c0f7aa8
Opcode Fuzzy Hash: 89413ede3b1e85be20c8f272e65a27b8bfe40e2a2e38e4141ba162e5d23f76ce
Instruction Fuzzy Hash: 18212C36618F858AE7508B28F45575A77A0FB89BB4F500335EAAD83BA9DF7CD144CB00

Function 000001EF1F211EA0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 000001EF1F211EF8
LocalFree.KERNEL32 ref: 000001EF1F211F8A

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 534917215b691bdf8008ca3940d01222a19eb5e5d5bf9c8332b99172fc4e0cb2
Instruction ID: 72c6a04f9a48602c377dc52ed6cbce3cdfce70fb7a4a8175bdd4ec8720db9821
Opcode Fuzzy Hash: 534917215b691bdf8008ca3940d01222a19eb5e5d5bf9c8332b99172fc4e0cb2
Instruction Fuzzy Hash: 6D414533618BC4CAE3208F74E4403DD37A4FB6978CF444229EE8856E8ADB79C5A5C745

Function 000001EF1F2213B0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32 ref: 000001EF1F221421

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: 05563d9c9f8d9765ab942f76f343afa8ceddb3167ad04ffcdfa04968ca2d4d44
Instruction ID: 67496f16bcd5dace04e217778ed6d94ab782141b5ecb37c30bd0766686b5861d
Opcode Fuzzy Hash: 05563d9c9f8d9765ab942f76f343afa8ceddb3167ad04ffcdfa04968ca2d4d44
Instruction Fuzzy Hash: 8F414C33A18BC4C2E710CF25E88439E7764FBA5784F545229EE8823A69DB78D5D2DB40

Function 000001EF1F220110 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 000001EF1F220155

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 5706546f313706de72a237bf98d2ae5729b4666c4094d2ca0903643dc08702f3
Instruction ID: 55cde317db66f6b3ae73647098af1c9c72d5fc686b163439dcf832b68bdc1192
Opcode Fuzzy Hash: 5706546f313706de72a237bf98d2ae5729b4666c4094d2ca0903643dc08702f3
Instruction Fuzzy Hash: 6D015E336186C482E720CF25E85139EA3A5FBA8788F440229AE9D42659DBBCC1D58B41

Function 000001EF1F220820 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

cores, xrefs: 000001EF1F220A7E

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID: cores
API String ID: 0-2370456839
Opcode ID: 58cf42691204f16d4da541265847817d2eacf75c695bb747bdd7a219ffcded3a
Instruction ID: 966c482650d8dd23d923e3f9be190d3fa6f27bfe35f642fc38cf1562b4fe0050
Opcode Fuzzy Hash: 58cf42691204f16d4da541265847817d2eacf75c695bb747bdd7a219ffcded3a
Instruction Fuzzy Hash: 7FC1D473E14BC48AE710CB78D4413DD6761EBA97A8F505329EEAC16A9ADB78C1C6C340

Function 000001EF1F2270B0 Relevance: 1.5, Strings: 1, Instructions: 212COMMON

Download Yara Rule

Strings

\u%04x, xrefs: 000001EF1F2272A2

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID: \u%04x
API String ID: 0-2916071157
Opcode ID: 06a80ac53363f504e8d291dc153b6a47b21947aca11156197ff4547b1ef6832f
Instruction ID: bd379e206f0325985b642b27a0be2ecb43f6008ac17e508463d50e90cc39c774
Opcode Fuzzy Hash: 06a80ac53363f504e8d291dc153b6a47b21947aca11156197ff4547b1ef6832f
Instruction Fuzzy Hash: 2081CD336086C8C2EB54DB25D5507EE6761FBA5B80F84803EDF6A83B95DB38C596C341

Function 000001EF1F22662B Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

": , xrefs: 000001EF1F226711, 000001EF1F2267BE

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID: ":
API String ID: 0-3662656813
Opcode ID: 896a4f67027aaf01e5dfe48ac692d3832c0c554c68eb6b2fca54ea41666aa8bb
Instruction ID: 4381ea5fdf3366d150af1f55d4b9428b97f926a08531950d9801dfd807b0fb8e
Opcode Fuzzy Hash: 896a4f67027aaf01e5dfe48ac692d3832c0c554c68eb6b2fca54ea41666aa8bb
Instruction Fuzzy Hash: 06911277304A89C1DB209F26D09479E6761FB98BC8F40901ACFAE47B65DF39C599CB02

Function 000001EF1F1E22D0 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 000001EF1F1E2359

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
API String ID: 0-1713319389
Opcode ID: 0e1e18df8e43834f8c2d261b7060e305521bf1430a60c216941d6cdd0af00934
Instruction ID: aea03c6c649078aa8ca9837e4b3986b10cc4cc147088bb8e1953713aff16b844
Opcode Fuzzy Hash: 0e1e18df8e43834f8c2d261b7060e305521bf1430a60c216941d6cdd0af00934
Instruction Fuzzy Hash: E141D0736196E48AD702CB3984113BD7FB1E366B88F1C81A2DBD487747C62DC256DB10

Function 000001EF1F1DCF60 Relevance: .7, Instructions: 715COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ee64277ec26fa9eb8a19cf9b95fe07225f7ac9934d4029661373a1f8689ff59
Instruction ID: 2420dfd167b1fae8bcfb867d3539a6f97484ec0d1a849d6a977962e2b8fcbe91
Opcode Fuzzy Hash: 2ee64277ec26fa9eb8a19cf9b95fe07225f7ac9934d4029661373a1f8689ff59
Instruction Fuzzy Hash: F5724B73615BC8C9EB20CB69E8403DD73A1F799798F504229EE9C67B99DB78C281C700

Function 000001EF1F1CF1C0 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a03f6542dbe3f7e8697fb30417c9446664b9eff22dd70cdc3f0f468801734f4b
Instruction ID: eaf0a8cacf3aa9fa000ba53a59a86a4970d3b58049d57cd0e44fec7345b9f6b9
Opcode Fuzzy Hash: a03f6542dbe3f7e8697fb30417c9446664b9eff22dd70cdc3f0f468801734f4b
Instruction Fuzzy Hash: 4BF12D73A15FC88AEB208B69E44139D77A4F79C7A8F104319EEDC57B99EB78C1918700

Function 000001EF1F1CF8B0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0a5ce49bdf3c9232aa9b921f9dd6628f2cc835ac63ebea273df0551bc5cf4d6
Instruction ID: 82a226638c6fb8d760ecbf96746f62da8ec735131afbd5b7667f3169825bdadc
Opcode Fuzzy Hash: c0a5ce49bdf3c9232aa9b921f9dd6628f2cc835ac63ebea273df0551bc5cf4d6
Instruction Fuzzy Hash: BEF13C73605FC88AEB208B69E44139D77A1F79C7A8F104319EEEC57B99EB78C1918740

Function 000001EF1F218B30 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 194
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001EF1F2188B0: InitializeCriticalSectionEx.KERNEL32 ref: 000001EF1F218901
Part of subcall function 000001EF1F2188B0: GetLastError.KERNEL32 ref: 000001EF1F21890B

EnterCriticalSection.KERNEL32 ref: 000001EF1F218B71
GdiplusStartup.GDIPLUS ref: 000001EF1F218B98
LeaveCriticalSection.KERNEL32 ref: 000001EF1F218BA6
LeaveCriticalSection.KERNEL32 ref: 000001EF1F218BD4
GdipGetImageEncodersSize.GDIPLUS ref: 000001EF1F218BE2
GdipGetImageEncoders.GDIPLUS ref: 000001EF1F218C76
GdipCreateBitmapFromScan0.GDIPLUS ref: 000001EF1F218D40
GdipSaveImageToStream.GDIPLUS ref: 000001EF1F218D5E
GdipDisposeImage.GDIPLUS ref: 000001EF1F218DC3
GdipDisposeImage.GDIPLUS ref: 000001EF1F218DD7

Strings

&, xrefs: 000001EF1F218D3A

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream
String ID: &
API String ID: 1703174404-3042966939
Opcode ID: e0228fc8eea7d5b1ef60bb9784c8d30ef67e4de2cf218bbc2f582390e882f76a
Instruction ID: cd12e1aa8a7008fd216d302035492f0e0b8b2b3452c5700d76aa32bf95fbe88f
Opcode Fuzzy Hash: e0228fc8eea7d5b1ef60bb9784c8d30ef67e4de2cf218bbc2f582390e882f76a
Instruction Fuzzy Hash: 69916A33605BC8DAEB20CF20D8807DD37A4FB75B98F548229EE2987B94DB74C5868345

Function 000001EF1F219BE0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 250
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001EF1F21F890: GetUserGeoID.KERNEL32 ref: 000001EF1F21F8B7
Part of subcall function 000001EF1F21F890: GetGeoInfoA.KERNEL32 ref: 000001EF1F21F8D1
Part of subcall function 000001EF1F21F890: GetGeoInfoA.KERNEL32 ref: 000001EF1F21F921

WSAStartup.WS2_32 ref: 000001EF1F219D59
socket.WS2_32 ref: 000001EF1F219D7A
htons.WS2_32 ref: 000001EF1F219DA0
inet_pton.WS2_32 ref: 000001EF1F219DE3
connect.WS2_32 ref: 000001EF1F219DFD
closesocket.WS2_32 ref: 000001EF1F219E1C
WSACleanup.WS2_32 ref: 000001EF1F219E22

Strings

system, xrefs: 000001EF1F219CC5
geo, xrefs: 000001EF1F219D06

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Info$CleanupStartupUserclosesocketconnecthtonsinet_ptonsocket
String ID: geo$system
API String ID: 213021568-2364779556
Opcode ID: aa2f5169524634d7e9323b3215f6a4000117be42a2ae9b0de516e33c6e21ac9c
Instruction ID: 8ed4e67a8e0840513a81258f9a8192be974195b2bea3438a77a83de6ff5cc544
Opcode Fuzzy Hash: aa2f5169524634d7e9323b3215f6a4000117be42a2ae9b0de516e33c6e21ac9c
Instruction Fuzzy Hash: 89C18B73B05BC8C5EB00DBA4D4503DD33A2EB65B98F41422ADE7D57AA9DA74C587C301

Function 000001EF1F223B30 Relevance: 13.6, APIs: 9, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000001EF1F223B61
GetProcessId.KERNEL32 ref: 000001EF1F223B6A
RmStartSession.RSTRTMGR ref: 000001EF1F223B8A
RmRegisterResources.RSTRTMGR ref: 000001EF1F223BB5
RmGetList.RSTRTMGR ref: 000001EF1F223BEE
RmGetList.RSTRTMGR ref: 000001EF1F223C50
RmEndSession.RSTRTMGR ref: 000001EF1F223C8B
RmEndSession.RSTRTMGR ref: 000001EF1F223CC2
RmEndSession.RSTRTMGR ref: 000001EF1F223CD7

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Session$ListProcess$CurrentRegisterResourcesStart
String ID:
API String ID: 3299295986-0
Opcode ID: fd498ee3de36280c394abacf9467fc5b9ce5ac8d70b1b0db778499f5d870b0f3
Instruction ID: f7025b5583b9dbdd195ea3a7c9c874774bef52300f50b12f02985c7c119d66e1
Opcode Fuzzy Hash: fd498ee3de36280c394abacf9467fc5b9ce5ac8d70b1b0db778499f5d870b0f3
Instruction Fuzzy Hash: CC512932705AD8CAF714CFA4E4546DD73A1FB69788F50413EEE1AA3B98DA34C8468B41

Function 000001EF1F23D5F0 Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F23DA1D

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 47550b20993fbd762e226fa4ca9e05ae32b1ced83bd225dda60327e294bd4ee8
Instruction ID: e3177463ba6d0c5d0c1a120742b41b94aee815ca217e35954610e72af36a1d0a
Opcode Fuzzy Hash: 47550b20993fbd762e226fa4ca9e05ae32b1ced83bd225dda60327e294bd4ee8
Instruction Fuzzy Hash: DCC1D1B32047CDC3E7619B15D4503ED7BA0EFA9B80F9541A9DE6A07395DA78C8CB8702

Function 000001EF1F218990 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 000001EF1F2189D3
EnterCriticalSection.KERNEL32 ref: 000001EF1F2189E5
EnterCriticalSection.KERNEL32 ref: 000001EF1F2189F5
GdiplusShutdown.GDIPLUS ref: 000001EF1F218A03
LeaveCriticalSection.KERNEL32 ref: 000001EF1F218A10
LeaveCriticalSection.KERNEL32 ref: 000001EF1F218A1A

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: 83031f1c3d95a3b59bc2a22e43b72ccd41805d9851eefa9cc92077698de98015
Instruction ID: 94a9c794a64856a99fd07087481d58f804a64d9a088bd18d6248059b4d9ee0c3
Opcode Fuzzy Hash: 83031f1c3d95a3b59bc2a22e43b72ccd41805d9851eefa9cc92077698de98015
Instruction Fuzzy Hash: 1E114633501BD4C1EB10DF24E88019D73A4FB66FA4B684329DE69462A4DF34C897C746

Function 00007FF617E77980 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF617E77C00: Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00007FF617E77C0E

Part of subcall function 00007FF617E66610: char_traits.LIBCPMTD ref: 00007FF617E6663D

Part of subcall function 00007FF617E77DC0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF617E77ED5

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF617E77AFA

Strings

LoadAcceleratorsW, xrefs: 00007FF617E77A33
LoadAcceleratorsA, xrefs: 00007FF617E77A73
LeaveCriticalSection, xrefs: 00007FF617E779C5
EnterCriticalSection, xrefs: 00007FF617E779FC

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID: Concurrency::details::_CriticalLock::_ProcessorReentrantScoped_lockScoped_lock::~_Virtual$Concurrency::RootRoot::char_traits
String ID: EnterCriticalSection$LeaveCriticalSection$LoadAcceleratorsA$LoadAcceleratorsW
API String ID: 2378420206-1394853731
Opcode ID: 04327c45c70a67150be1c73c2e078c6eac2a998af2c452a8fcebf7652b8d46cf
Instruction ID: 2821deffe2c161f9a05c5a3cc4c190fdf0fab90ed93935ab7bb1378959b73f40
Opcode Fuzzy Hash: 04327c45c70a67150be1c73c2e078c6eac2a998af2c452a8fcebf7652b8d46cf
Instruction Fuzzy Hash: 2151022255DDC295EA30DB54E4513EFA3A0FBD5B54F401032E28DC7AABDE2CD645CB80

Function 000001EF1F21E9F0 Relevance: 6.4, APIs: 4, Instructions: 417networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 000001EF1F21EBCC
recv.WS2_32 ref: 000001EF1F21F0AC
closesocket.WS2_32 ref: 000001EF1F21F0BE
WSACleanup.WS2_32 ref: 000001EF1F21F0C4

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: recv$Cleanupclosesocket
String ID:
API String ID: 146070474-0
Opcode ID: 8617c0c3cb97ca130137414e1e59b4641afa0d81757e1cfab694a00b388a34e4
Instruction ID: 6f7bea7f930642d63733a398e913e7c590f01510739da19bf24f07fc368aaac5
Opcode Fuzzy Hash: 8617c0c3cb97ca130137414e1e59b4641afa0d81757e1cfab694a00b388a34e4
Instruction Fuzzy Hash: 33128173A18BC8C1EA21DB14E4543DE6761FBA9790F504229EEBD46ADADF78C4C2C701

Function 00007FF617E77FD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF617E780EF
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF617E78197

Part of subcall function 00007FF617EB77D4: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF617EB651B), ref: 00007FF617EB7824
Part of subcall function 00007FF617EB77D4: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF617EB651B), ref: 00007FF617EB7865

Strings

1.3.1.zlib-ng, xrefs: 00007FF617E7802D

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_$ExceptionFileHeaderRaise
String ID: 1.3.1.zlib-ng
API String ID: 543713560-992988628
Opcode ID: 8956c29817721c66e9a5c783700e556b24576ee2f69ddabf96bd024d6e1e8483
Instruction ID: 2b21c2cd36b34f11f6d67a666a70a5359d4b796b562a2ab6ba46ef0d8d3e9cb2
Opcode Fuzzy Hash: 8956c29817721c66e9a5c783700e556b24576ee2f69ddabf96bd024d6e1e8483
Instruction Fuzzy Hash: AD61C83261CAC286E670DB14E4513ABB3A0FBD8754F904136E6CD83A9ADF3CD645CB80

Function 000001EF1F220420 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegGetValueA.ADVAPI32 ref: 000001EF1F220489

Strings

ProductName, xrefs: 000001EF1F220474
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 000001EF1F22047B

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Value
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-1787575317
Opcode ID: 848e5551118642d687fb9cd25162ca569aafd51f714130a4cf12862d48b99029
Instruction ID: 65f07dc72a10feaef434ff3585cb445ff1d4b312d05c03c21da75e30fd589383
Opcode Fuzzy Hash: 848e5551118642d687fb9cd25162ca569aafd51f714130a4cf12862d48b99029
Instruction Fuzzy Hash: 1F113032118BC4C2D710CF21F45139AB3A4FBA9794F914229EE9847B59DFBCC195CB40

Function 000001EF1F22B090 Relevance: 4.9, APIs: 3, Instructions: 440COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F22B26B
Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F22B474
Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F22B5F0

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 44d4abd68d1500e908a8f15b917e2edf606cc9c21f599a0dace8c81027a59553
Instruction ID: acbc8497b16e241a2c7578b9ebafa346fab9de1ab90576b1cf6c8bbbc2dfb770
Opcode Fuzzy Hash: 44d4abd68d1500e908a8f15b917e2edf606cc9c21f599a0dace8c81027a59553
Instruction Fuzzy Hash: 55F19F73211BC8C2DA24CB25E4547AD63A4FB68BE4F58462DAFBD47B95DB38C192C301

Function 000001EF1F21ED77 Relevance: 4.7, APIs: 3, Instructions: 182networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 000001EF1F21F0AC
closesocket.WS2_32 ref: 000001EF1F21F0BE
WSACleanup.WS2_32 ref: 000001EF1F21F0C4

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Cleanupclosesocketrecv
String ID:
API String ID: 3447645871-0
Opcode ID: 609ff855d8c389044ae14b46d5b4c35e90766f3e6cfc784a2336127d0299b595
Instruction ID: 6d6ae0197ef173e638e945292402accd6886761ec7348bb5a3627df0690ed90b
Opcode Fuzzy Hash: 609ff855d8c389044ae14b46d5b4c35e90766f3e6cfc784a2336127d0299b595
Instruction Fuzzy Hash: D8917173A18BC8C1EA208B14E4543DE6761EBA97A0F504329DEBD47ADADF79C4C2C701

Function 000001EF1F221111 Relevance: 4.7, APIs: 3, Instructions: 163registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000001EF1F221129
RegEnumKeyExA.ADVAPI32 ref: 000001EF1F22116E
RegCloseKey.ADVAPI32 ref: 000001EF1F221364

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: 866ecde12c4900e59f76d10c61653feda9dac359a6bfa9f0c5534175a3217374
Instruction ID: b6d0e8f49bf6e542d4c598861b5e66ee262e8cb633d7e7704fa741be3e81f477
Opcode Fuzzy Hash: 866ecde12c4900e59f76d10c61653feda9dac359a6bfa9f0c5534175a3217374
Instruction Fuzzy Hash: 57717273A04BC8C5EB10CB65E48479D6761FBA57A8F200329EEB957AD9DB78D0C2C701

Function 00007FF617E6D7F0 Relevance: 4.6, APIs: 3, Instructions: 112COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FF617E6D8DD
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FF617E6D9C0
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF617E6D9E9

Part of subcall function 00007FF617E66610: char_traits.LIBCPMTD ref: 00007FF617E6663D

Part of subcall function 00007FF617E6DAA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF617E6DAB8

Part of subcall function 00007FF617E6DB00: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF617E6DB13

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID: Concurrency::details::Work$EmptyQueue::Structured$Base::ContextIdentityQueue$char_traits
String ID:
API String ID: 2573577243-0
Opcode ID: f26d7d76682de479d1a510b7515a2100360f65aa1e8371ebd0398830a94be955
Instruction ID: 9e2f83c7a61aa72506414b2ee21b68c5d446549d303970fcfeaebbf10585daac
Opcode Fuzzy Hash: f26d7d76682de479d1a510b7515a2100360f65aa1e8371ebd0398830a94be955
Instruction Fuzzy Hash: 6051F96261DFC691DA20DB15E4513ABB3A0FBC5B94F804032E6CD87B6BDE2CD585CB40

Function 000001EF1F2210A0 Relevance: 4.6, APIs: 3, Instructions: 96registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000001EF1F221129
RegEnumKeyExA.ADVAPI32 ref: 000001EF1F22116E

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: EnumOpen
String ID:
API String ID: 3231578192-0
Opcode ID: f2e07ec76756ed61d5ea5d4f7ada0feb90a09d0fd6799f6eeab6a948dfa74451
Instruction ID: 04413f953b3ab420173499a202f87b1050031207d01175b2dfc7ebdbbf8db053
Opcode Fuzzy Hash: f2e07ec76756ed61d5ea5d4f7ada0feb90a09d0fd6799f6eeab6a948dfa74451
Instruction Fuzzy Hash: BE317F33610BC8C5E720CBA5E850BDE7364FB65798F600229EEA957A54DB78C1D6C700

Function 00007FF617E717D0 Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

_CallMemberFunction0.LIBCPMTD ref: 00007FF617E71850
_CallMemberFunction0.LIBCPMTD ref: 00007FF617E718CD
_CallMemberFunction0.LIBCPMTD ref: 00007FF617E71928

Part of subcall function 00007FF617E6A560: char_traits.LIBCPMTD ref: 00007FF617E6A593

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID: CallFunction0Member$char_traits
String ID:
API String ID: 1927575840-0
Opcode ID: b3a0a285e39b8cf687cbf5e33b540a6d49c497df54d9ecd142d2dcea34095149
Instruction ID: 06c08c9a1363a20654b27ce8025fb2516ef5429984cb7ecb03d772a9f2f00c3e
Opcode Fuzzy Hash: b3a0a285e39b8cf687cbf5e33b540a6d49c497df54d9ecd142d2dcea34095149
Instruction Fuzzy Hash: 24312E62A0DF4285E720DB15E44116B77E2FBC9BA4F505135E28DC76ABDE3CE641CB80

Function 000001EF1F220DDB Relevance: 4.6, APIs: 3, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000001EF1F220DF7
RegQueryValueExA.ADVAPI32 ref: 000001EF1F220E36
RegCloseKey.ADVAPI32 ref: 000001EF1F220ED4

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: bb72164ad1160d40e3a75e7481e2f4229b5a897f4fd7f573111bd3cb0f92ed32
Instruction ID: 64fb7f79da6fd18a76224ddca9cbc2d8c9cbe20d95559b627e2665106e5d39e7
Opcode Fuzzy Hash: bb72164ad1160d40e3a75e7481e2f4229b5a897f4fd7f573111bd3cb0f92ed32
Instruction Fuzzy Hash: AA218F73614BC8C1EB50CB25E05139EB361FBEA7D4F40522AEEAD42A99DE2CC1C5CB01

Function 00007FF617E782A0 Relevance: 4.6, APIs: 3, Instructions: 51COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF617E782DB
OpenProcessToken.ADVAPI32 ref: 00007FF617E782EE
GetTokenInformation.KERNELBASE ref: 00007FF617E78336

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID: ProcessToken$CurrentInformationOpen
String ID:
API String ID: 2743777493-0
Opcode ID: 722ab832dbefb05b570a67b2cccdef345e5e387398dfdff30b5f0e262e84267a
Instruction ID: ef0182c0ec98e9a9dd0814d2f73598fca2357eb48755a99042639e0b30a214cd
Opcode Fuzzy Hash: 722ab832dbefb05b570a67b2cccdef345e5e387398dfdff30b5f0e262e84267a
Instruction Fuzzy Hash: 6B21602262CA8181EB40DB15E4513AFBBA0FB91B54F941035F78E83A9BDF3DD508CB40

Function 000001EF1F21F890 Relevance: 4.6, APIs: 3, Instructions: 50COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32 ref: 000001EF1F21F8B7
GetGeoInfoA.KERNEL32 ref: 000001EF1F21F8D1
GetGeoInfoA.KERNEL32 ref: 000001EF1F21F921

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: d34c2ece54cb3812040e4eef0477fed434900964bc97860851aa3e607d5351a2
Instruction ID: 9f74e49a397e7cec6e9c5987b38a04d88823fee2b84d6ee23742715801c164b5
Opcode Fuzzy Hash: d34c2ece54cb3812040e4eef0477fed434900964bc97860851aa3e607d5351a2
Instruction Fuzzy Hash: AE1179326187C582E7109F61F41475EB3A1FBA6B88F045228EF8503B59DF7CD5918B85

Function 000001EF1F219760 Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000001EF1F21979B
OpenProcessToken.ADVAPI32 ref: 000001EF1F2197AE
GetTokenInformation.ADVAPI32 ref: 000001EF1F2197EA

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: ProcessToken$CurrentInformationOpen
String ID:
API String ID: 2743777493-0
Opcode ID: 5cf106d3b2ffd2a7e9a61a7f883b18dc6c947c023f1ec599732081f4b0d6fdce
Instruction ID: dc922429fadc789af41500e97c1a77bfb8a41a513cd738dc4a4d89439a9e09ca
Opcode Fuzzy Hash: 5cf106d3b2ffd2a7e9a61a7f883b18dc6c947c023f1ec599732081f4b0d6fdce
Instruction Fuzzy Hash: 4711FC32618BC482E7509F15F84034EB2A0FB95B80F555129EEA997B68CF38C446CB45

Function 000001EF1F243270 Relevance: 4.5, APIs: 3, Instructions: 15COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000001EF1F243281
TerminateProcess.KERNEL32 ref: 000001EF1F24328C
ExitProcess.KERNEL32 ref: 000001EF1F24329B

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: f80d91bcf93e8424b3640f1b7356e3f7b22acd1ad7b3684da8aa45f97133e79c
Instruction ID: b499fad7580ff09ef6e6d55dbb7fa181c67c5a9ec258363ec20366ca0b7a7515
Opcode Fuzzy Hash: f80d91bcf93e8424b3640f1b7356e3f7b22acd1ad7b3684da8aa45f97133e79c
Instruction Fuzzy Hash: 1BD067363006CCD2FA18AB70A8992DD22256F7A701F10593CCD22467D7CD698CCA5612

Function 000001EF1F1DF350 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F1DF53C

Strings

, xrefs: 000001EF1F1DF3D3

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-3916222277
Opcode ID: 6c07074f43804ca48068e3669103e1ea88a4ad1301297c00d1ef59d492acbb63
Instruction ID: 8ddbca3c840375d905bcafbf043e21ee1032061d26cfdbcbb9f50e09666dfcca
Opcode Fuzzy Hash: 6c07074f43804ca48068e3669103e1ea88a4ad1301297c00d1ef59d492acbb63
Instruction Fuzzy Hash: E9512773204B88D6EA158F2AD15839C33A0FB68B94F58462ADF5D57BA5CF79D1A3C300

Function 000001EF1F220C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32 ref: 000001EF1F220C6C

Strings

Unknown, xrefs: 000001EF1F220D26

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: 23c938e7993db7c49b129263db71837a29bf102ed93c0002fe98e8a6915ab8d6
Instruction ID: d800211d065984d42d610de19a1bcc61d0fbd8919bd55328da205596a22cdc38
Opcode Fuzzy Hash: 23c938e7993db7c49b129263db71837a29bf102ed93c0002fe98e8a6915ab8d6
Instruction Fuzzy Hash: 4031BE33628BC4C6E711CB24E4503DEA360FBA9744F545229EFD916A5ADB7CC6D6CB00

Function 00007FF617E6FAE0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_CRT_INIT.LIBCMTD ref: 00007FF617E6FB9A

Strings

@, xrefs: 00007FF617E6FB6E

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: b337b7728e22acf7a85b468339197ec44de5b842342dd1561fc2dcb21d3dd529
Instruction ID: 4145e7aebf99cfd1849475c40c6d5536b6b358d343394f36a630b3730cb827c1
Opcode Fuzzy Hash: b337b7728e22acf7a85b468339197ec44de5b842342dd1561fc2dcb21d3dd529
Instruction Fuzzy Hash: 3B31B87661DB818AD760DB25E45062BBBE0F788B94F500525FB8D83B5ADF3CD6408F40

Function 000001EF1F1E51E0 Relevance: 3.2, APIs: 2, Instructions: 192COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F1E5320
Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F1E541F

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 1c6e8d4d7363a70b3ba52969144ac9adb36c42fe63d4cefd70ba9a4a2fc8c6fb
Instruction ID: 157528522dd08e234f65ef0ee1e7e932540d804c61a960d47688f7c2c1e006a4
Opcode Fuzzy Hash: 1c6e8d4d7363a70b3ba52969144ac9adb36c42fe63d4cefd70ba9a4a2fc8c6fb
Instruction Fuzzy Hash: 8251D773311BC8C5EE259B15E5003DD6391AB64BE4F5806399E6E9BBD7EA78C4C39300

Function 000001EF1F218E10 Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 000001EF1F218E69
CoTaskMemFree.OLE32 ref: 000001EF1F218F2A

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: FolderFreeKnownPathTask
String ID:
API String ID: 969438705-0
Opcode ID: 580e4ec995c025e236e0119286df238f7e33c8c91af7f6f13076045bdd61eb5d
Instruction ID: 0c9b3e357ad8154c7141bf50c70271f4016ff7e477212ef88e68685b9df9617c
Opcode Fuzzy Hash: 580e4ec995c025e236e0119286df238f7e33c8c91af7f6f13076045bdd61eb5d
Instruction Fuzzy Hash: 16315373914BC481E720CB29E49039EA761FBA97A4F545329FEAC42A95DB78C1C28B40

Function 000001EF1F22E614 Relevance: 3.1, APIs: 2, Instructions: 77COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F22E63B

Part of subcall function 000001EF1F22E5D0: _invalid_parameter_noinfo.LIBCMT ref: 000001EF1F22E5E7

_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F22E6EF

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cb30a7c2c620b97f400ef9b33bc0fdb0214d80daa24a11497eeb67f4fc095207
Instruction ID: e4086214194c9e83d2b3f40be06655902624b4d35b5ccc009d23798c6c318ecf
Opcode Fuzzy Hash: cb30a7c2c620b97f400ef9b33bc0fdb0214d80daa24a11497eeb67f4fc095207
Instruction Fuzzy Hash: 1A319C33210AC8C2EB54DB54E8513ED6361AFB4B80F98053DEE29873D2EA78C5869302

Function 000001EF1F217390 Relevance: 3.1, APIs: 2, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000001EF1F2173E1
RegCloseKey.ADVAPI32 ref: 000001EF1F2173F3

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: f079ec761da95b766b8b6afbeec7fda29d97571b2deafd3f5d4343d11bd09f0c
Instruction ID: c7346454ee244b110cfb3782aa1aad931c8c356127901de9aa31194f37f39816
Opcode Fuzzy Hash: f079ec761da95b766b8b6afbeec7fda29d97571b2deafd3f5d4343d11bd09f0c
Instruction Fuzzy Hash: CB21B433B15AC8C5EA509B21E4403DEA760EFA9BD4F441239EE5D83B99DA28C5C2C705

Function 000001EF1F21664C Relevance: 3.1, APIs: 2, Instructions: 58synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 000001EF1F1DC8C0: CreateToolhelp32Snapshot.KERNEL32 ref: 000001EF1F1DC90A
Part of subcall function 000001EF1F1DC8C0: Process32FirstW.KERNEL32 ref: 000001EF1F1DC94C

Part of subcall function 000001EF1F1DACC0: CredEnumerateA.ADVAPI32 ref: 000001EF1F1DAD22

Part of subcall function 000001EF1F21E9F0: recv.WS2_32 ref: 000001EF1F21EBCC

ReleaseMutex.KERNEL32 ref: 000001EF1F2166BB
CloseHandle.KERNEL32 ref: 000001EF1F2166C4

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: CloseCreateCredEnumerateFirstHandleMutexProcess32ReleaseSnapshotToolhelp32recv
String ID:
API String ID: 420082584-0
Opcode ID: a37b51bf11844fede821996e29e0b0eb991c5f59063565115c5bd1381c00078c
Instruction ID: 5bf20048add0b86153ab6c0af0fa1caf1e42f187b69fbefcb5276c57c703455b
Opcode Fuzzy Hash: a37b51bf11844fede821996e29e0b0eb991c5f59063565115c5bd1381c00078c
Instruction Fuzzy Hash: D421B173A48ACCC1F921B3B4E02A3DD1660AFB6791F54463CEDB9915C7DE1880C38527

Function 000001EF1F21667D Relevance: 3.0, APIs: 2, Instructions: 47synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 000001EF1F21E9F0: recv.WS2_32 ref: 000001EF1F21EBCC

ReleaseMutex.KERNEL32 ref: 000001EF1F2166BB
CloseHandle.KERNEL32 ref: 000001EF1F2166C4

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: CloseHandleMutexReleaserecv
String ID:
API String ID: 2659716615-0
Opcode ID: f7759426930724b6cecb2256aca7aa0a691b844007321e003cd8510a4262878b
Instruction ID: 8db6fb08352680310967c5506726d72b8eaf1cfac7f7535102e47afcf5f8ed6b
Opcode Fuzzy Hash: f7759426930724b6cecb2256aca7aa0a691b844007321e003cd8510a4262878b
Instruction Fuzzy Hash: 8911E0B3A08ACCC1FA20B728E02A3DD1250EFB6790F44063CEEB9815D7DE1880C38617

Function 000001EF1F23DB60 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 000001EF1F23DBAC
GetLastError.KERNEL32 ref: 000001EF1F23DBB6

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7e9ab1c6d8c64915d6648e9c143c2363700413bfa3c055332623f50353a46816
Instruction ID: 205c6a22b2e83feaf721a64d68a102d10051d3cbdce9c1a1c0b97ff198e351f1
Opcode Fuzzy Hash: 7e9ab1c6d8c64915d6648e9c143c2363700413bfa3c055332623f50353a46816
Instruction Fuzzy Hash: 6211A773314BC8C2DA108B25E45429D6362FB65BF4F944369EE79477D9CF78C0928702

Function 00007FF617E6D750 Relevance: 3.0, APIs: 2, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF617E6D768
GetProcAddress.KERNEL32 ref: 00007FF617E6D789

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: bd71bcfb797b50c55a6df7201416778f22323b2fa91c79af38a8b0c2d0370c92
Instruction ID: 7de576a5132c4d214ff4dfe91d2c501eb4f7d3c45d0ab4cea0030982cac1066c
Opcode Fuzzy Hash: bd71bcfb797b50c55a6df7201416778f22323b2fa91c79af38a8b0c2d0370c92
Instruction Fuzzy Hash: F701F77651CB8589DA60CB11E48032BBBE0F788BA4F501535F6CE82B69CF3CD2948B04

Function 000001EF1F24CB98 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F24CBC8

Part of subcall function 000001EF1F24DBEC: std::bad_alloc::bad_alloc.LIBCMT ref: 000001EF1F24DBF5

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F24CBCE

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 267b89f17236609d1417f10d46edbd95984192d968a560c5371d581f7ac22313
Instruction ID: 1ef1e1758e1eee9c319e40e16cb1d6c08eedb7848857f2cb680714efc7c107a4
Opcode Fuzzy Hash: 267b89f17236609d1417f10d46edbd95984192d968a560c5371d581f7ac22313
Instruction Fuzzy Hash: 16E0EC736516DDC2F928677AD8252FC00844F39770E1C1B3D5D7506AC3E994C4D38552

Function 00007FF617EA5810 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,00007FF617EA5929,00007FF617EAACD6,?,?,?,00007FF617EAB053,?,?,00000000,00007FF617EAB9B9,?,?,?,00007FF617EAB8EB), ref: 00007FF617EA5826
GetLastError.KERNEL32(?,?,00007FF617EA5929,00007FF617EAACD6,?,?,?,00007FF617EAB053,?,?,00000000,00007FF617EAB9B9,?,?,?,00007FF617EAB8EB), ref: 00007FF617EA5830

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: d1c0f4e6f877c9d6cfcd8a19c59eeb7a423ced942baaa3383c8ac58c4f15d072
Instruction ID: 0b8c293a0c095965a26312ee34cdd3a1f8e74430de6e2403080bd1e3bbcacef6
Opcode Fuzzy Hash: d1c0f4e6f877c9d6cfcd8a19c59eeb7a423ced942baaa3383c8ac58c4f15d072
Instruction Fuzzy Hash: 12E08C55F08E0283FF086BB2689607A27F15F84F32F144430CC0DCA2A3EF2CA8819300

Function 000001EF1F23B550 Relevance: 2.5, APIs: 2, Instructions: 18memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 000001EF1F23B566
GetLastError.KERNEL32 ref: 000001EF1F23B570

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 47cbcda289b4926f8a5fa232dbc04e0ffd722977d505590b0caac84d58b1b127
Instruction ID: 132f8ecb2641f4850398c1460d770d2e74223fdaebaa42c318db66877afb28d2
Opcode Fuzzy Hash: 47cbcda289b4926f8a5fa232dbc04e0ffd722977d505590b0caac84d58b1b127
Instruction Fuzzy Hash: 11E08CB2B012CCC3FE1867F2D8492AC02516F7A740F0801788D35C2292ED2449C64202

Function 000001EF1F22D450 Relevance: 1.7, APIs: 1, Instructions: 189COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F22D6A0

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 3de0bb872a4ced99b3461719a247294919f5c6187df7bd8ce26f5719ef776ffe
Instruction ID: b7490dae6a47ea621e4468921570d7e9d7b82d1e77ee873f08b9e79f944ab3d8
Opcode Fuzzy Hash: 3de0bb872a4ced99b3461719a247294919f5c6187df7bd8ce26f5719ef776ffe
Instruction Fuzzy Hash: 0361AD73200AC8C5EB259F16E1643AC23A1AB24F98F94852DDE6D8B7D5DA78C8D7C301

Function 000001EF1F1CE150 Relevance: 1.7, APIs: 1, Instructions: 175COMMON

Download Yara Rule

APIs

__std_fs_directory_iterator_open.LIBCPMT ref: 000001EF1F1CE283

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: __std_fs_directory_iterator_open
String ID:
API String ID: 4007087469-0
Opcode ID: 09c3d12c3065ae4d5b18b4ab33df85c87bef0ef2a9e7eedf7ec5a3e7bda915f9
Instruction ID: 8d0d898eb5050a39abca89f5d3cf17651bd28d94b89992023513b63e6f99a2e2
Opcode Fuzzy Hash: 09c3d12c3065ae4d5b18b4ab33df85c87bef0ef2a9e7eedf7ec5a3e7bda915f9
Instruction Fuzzy Hash: 6E61B173B00AC8C5FB10DBA9D4913EC23A1EB65798F505639DE2967AD5DA34C8D78340

Function 000001EF1F1E5B00 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F1E5C95

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 5f734f89e121393218bfa89cd2150b654cdf271e265cf260d8858e63b9b3724d
Instruction ID: b5a1e3fd5ccd7fff6fc29b3a216159e10818fbf486eaae8c7b02724b92589ed9
Opcode Fuzzy Hash: 5f734f89e121393218bfa89cd2150b654cdf271e265cf260d8858e63b9b3724d
Instruction Fuzzy Hash: 5641AE73304BC8C5EA119F16E4443DD6366BBA8BD4F580639DFAE5B796EA38C0829304

Function 000001EF1F1E9ED0 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F1EA034

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: d243ac50de2c8c9fea6c29278dfef3fc0bb35fb888659e4b002118cf497ee55e
Instruction ID: 4d67eb7ccc8949b4e76d12dc14d4b84fb2cfa8fb63cc363e4b439ba2e67bfa08
Opcode Fuzzy Hash: d243ac50de2c8c9fea6c29278dfef3fc0bb35fb888659e4b002118cf497ee55e
Instruction Fuzzy Hash: 0931D173301AC881ED15DB16E4046DE6790BB64BE4F944A39AE6E27BD6CE39C0839300

Function 000001EF1F1E5CB0 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F1E5E2C

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 06537a7ba540c1a5300730ad9c59412aaea285a4b1102b37b414c66f630cb10d
Instruction ID: 3310f8cd4b934f80ff6691c0fdb3051369f7f291c5fbcebf9a5e5ce0d4bffe66
Opcode Fuzzy Hash: 06537a7ba540c1a5300730ad9c59412aaea285a4b1102b37b414c66f630cb10d
Instruction Fuzzy Hash: 6141C173300BC8C5EE11DB16E5083DDA251BB64BD4F5446399EAE9BBD6EA38C183A700

Function 000001EF1F1E15C0 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F1E1711

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: c8f35241680a78ad30887ff165a9545e894890fe3596c2921fb291b78a2a9208
Instruction ID: 9c90ba73ba31bf1582ccacc9dd1839670c80436a3c4f7c4a56edcac279717aee
Opcode Fuzzy Hash: c8f35241680a78ad30887ff165a9545e894890fe3596c2921fb291b78a2a9208
Instruction Fuzzy Hash: 1A31D373701AC8C5FE169B56E5103ED12919B29FE4F5806399E2E27BD7EA74C4D3A300

Function 000001EF1F23BA50 Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F23BA78

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 62a68b64f697a3323ce5c67975f603dd912b7630c4b3619a8df593f8b8e10b11
Instruction ID: 908bc45acdaabbc018143d645bf7cd79b63393a1f8b4adfa314d8c704d8b15e0
Opcode Fuzzy Hash: 62a68b64f697a3323ce5c67975f603dd912b7630c4b3619a8df593f8b8e10b11
Instruction Fuzzy Hash: 7241D4B31046C8C7EA348F15D56139D73A0FB7AB80F180169DEA687694CB28C483C753

Function 000001EF1F1E5990 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F1E5AEB

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: e041cf908c7806a460978dffd14b77cdf62e9f26ca05f709f980f8a42ad1ed41
Instruction ID: 1beb3d530acf88dc2f48a29ce47156079a9afd12b968c662e520c2a83b9c8a47
Opcode Fuzzy Hash: e041cf908c7806a460978dffd14b77cdf62e9f26ca05f709f980f8a42ad1ed41
Instruction Fuzzy Hash: D83102733017C8C4EE119B16E5843CC6351AFA4BD4F184639AE6E5BBC6EA78C0C3A300

Function 000001EF1F220250 Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32 ref: 000001EF1F2202E0

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 08e4572989bba9d8d59fddbb911f8b4ea3613f7b15f1e0c28b03354269a55b2f
Instruction ID: 5b4f6df284079f727a0e9a1e664b8f89ad3d14dd11403fd9ed8ec85153534dfe
Opcode Fuzzy Hash: 08e4572989bba9d8d59fddbb911f8b4ea3613f7b15f1e0c28b03354269a55b2f
Instruction Fuzzy Hash: 0A516C33A14BC4C6E710CB68D4803DD7765FBA9788F504229EFAC53A99DB78C586C741

Function 00007FF617E77DC0 Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF617E7B970: _Byte_length.LIBCPMTD ref: 00007FF617E7B9F6

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF617E77ED5

Part of subcall function 00007FF617E7BA40: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF617E7BA6A

Part of subcall function 00007FF617E7BAA0: _Byte_length.LIBCPMTD ref: 00007FF617E7BB26

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID: Byte_lengthConcurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_
String ID:
API String ID: 2675252387-0
Opcode ID: 8cf2c1331036d997b2d5cbdfd09f9a6dace60c7598b65e1a7ef6aa7a93a04358
Instruction ID: 794d5259026a629820f8bf3f001c667a06def822b1d9ea9b9920191837edfccd
Opcode Fuzzy Hash: 8cf2c1331036d997b2d5cbdfd09f9a6dace60c7598b65e1a7ef6aa7a93a04358
Instruction Fuzzy Hash: 7F513C3261DEC595EA60EB14E4503DBB3A1FBC4B94F804036E68D87B6ADE3CD549CB40

Function 00007FF617E6BA90 Relevance: 1.6, APIs: 1, Instructions: 95COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF617E6C520: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF617E6C53D
Part of subcall function 00007FF617E6C520: _Max_value.LIBCPMTD ref: 00007FF617E6C562
Part of subcall function 00007FF617E6C520: _Min_value.LIBCPMTD ref: 00007FF617E6C590

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF617E6BB3C

Part of subcall function 00007FF617E64310: std::_Xinvalid_argument.LIBCPMT ref: 00007FF617E6431B

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$Max_valueMin_valueXinvalid_argumentstd::_
String ID:
API String ID: 142707115-0
Opcode ID: 60dc388cca3665f00380207ba0fc440bb0a5f3e9cb1ca1dbde5340a79cbc7bc9
Instruction ID: 0743ac8e55b6fedb170bc77ff141a2233042d9d87d90a601c254d2a7e76f86d0
Opcode Fuzzy Hash: 60dc388cca3665f00380207ba0fc440bb0a5f3e9cb1ca1dbde5340a79cbc7bc9
Instruction Fuzzy Hash: 8C519F36629FC581DA60DB56F49026BB7A1F7C9B94F101026FB8E83B2ADF3CD5508B40

Function 000001EF1F1D4E90 Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F1D4FAE

Part of subcall function 000001EF1F1CB7B0: __std_exception_copy.LIBVCRUNTIME ref: 000001EF1F1CB7F8

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy
String ID:
API String ID: 317858897-0
Opcode ID: 2b26ec282fc8c4ed485fce7933239b66542e7d8fb1000ec4d107d023d18fdfd6
Instruction ID: f7639f8ec3e8d013afe683f210587d31c207fe6e0ec942b9e3591206acda6bf6
Opcode Fuzzy Hash: 2b26ec282fc8c4ed485fce7933239b66542e7d8fb1000ec4d107d023d18fdfd6
Instruction Fuzzy Hash: 2331A073A01AD8C1EE18DB19E1143EC62A0AB64BB4F2447399E7D57BE5EB78C4D38340

Function 000001EF1F1DFE50 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F1DFF58

Part of subcall function 000001EF1F1CB7B0: __std_exception_copy.LIBVCRUNTIME ref: 000001EF1F1CB7F8

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy
String ID:
API String ID: 317858897-0
Opcode ID: 7b80adb482ef6766f29c128180fde28b413faead996806e72a29ec464a59cb0e
Instruction ID: 3074a79ad7eec4c39e128256950250dd411ad90eda4e814a8d8638b1d0be24eb
Opcode Fuzzy Hash: 7b80adb482ef6766f29c128180fde28b413faead996806e72a29ec464a59cb0e
Instruction Fuzzy Hash: 3F21E333A01BC8C1EA18EB15E1443EC22A0AF64BA4F2446399E7C57BD2EA78C5D39340

Function 000001EF1F23D4D0 Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F23D556

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 90e282629e3327800b1a09ea2473f0e2941ce1167cc6a0942764be9094e0e12c
Instruction ID: 71528e70e5cf53f5ca2038fffe50e430cab9e99c34d73f8b153e1fb340562ed1
Opcode Fuzzy Hash: 90e282629e3327800b1a09ea2473f0e2941ce1167cc6a0942764be9094e0e12c
Instruction Fuzzy Hash: 493192B36146DCC3FB155B59C8513DC2650AF68B68F9101AE9E35473D2DA78C8C78712

Function 00007FF617E6F580 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8832b93c38650351119958a3682aaab50e8cbc8b9dc0623d89af5356b64ee8a2
Instruction ID: 183624c26ddc3f8efd2e60a4d01191c1cb528fe7459779f87571b31b5ad1febb
Opcode Fuzzy Hash: 8832b93c38650351119958a3682aaab50e8cbc8b9dc0623d89af5356b64ee8a2
Instruction Fuzzy Hash: E031D56662CBC181DA509B56E45076FB7A0FB85BE4F401036FBCD87BAADE6CD5008B80

Function 000001EF1F2431A1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001EF1F2431CF

Part of subcall function 000001EF1F2432C8: GetModuleHandleExW.KERNEL32 ref: 000001EF1F2432ED
Part of subcall function 000001EF1F2432C8: GetProcAddress.KERNEL32 ref: 000001EF1F243303
Part of subcall function 000001EF1F2432C8: FreeLibrary.KERNEL32 ref: 000001EF1F24332A

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 530d5f225501611c07fa3f753d7d8dc80cca454b0254b6cc05cb90d306267795
Instruction ID: 9aa2ca28ada104de980428314091e2ceeea437e29de04f4b242a02d1eb82f7a4
Opcode Fuzzy Hash: 530d5f225501611c07fa3f753d7d8dc80cca454b0254b6cc05cb90d306267795
Instruction Fuzzy Hash: A9213D32A016C8CAEB25DFA8D4443EC37A0EB64718F544639DE2907AD5DBB4CD86DB41

Function 000001EF1F25E208 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F25E22B

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c41a516aab5bbd5a0cb5ee3d8915c07e5e449c965519035ee3790c186b832703
Instruction ID: cfaf37704c635386c2d21bb0f155cc7c838503c1d918d961ad924c4658b1b4d8
Opcode Fuzzy Hash: c41a516aab5bbd5a0cb5ee3d8915c07e5e449c965519035ee3790c186b832703
Instruction Fuzzy Hash: 95219973214AC4C7D7658F18D4403ED76A1EBA4B54F548238DF79876E9DB39C8868F01

Function 000001EF1F25C510 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F25C46D

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6080b6f5c7735027f4532a4154f17099be5a1c2b37b88469d38b788aa2f2ab04
Instruction ID: 9bcdc9e47f63a83dfcc9a673ae81bde92ca71d5ee43b15a62d5fd52eb03d2694
Opcode Fuzzy Hash: 6080b6f5c7735027f4532a4154f17099be5a1c2b37b88469d38b788aa2f2ab04
Instruction Fuzzy Hash: F6117833618AC8C3EA609F61D4007FDA2A0FFA5B84F544539EE94476A6DB79C5C38B42

Function 00007FF617E6E170 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 292d0802afc3662b8a44df9434c69ee7ab1bc2423aa3cf29da608adeab93335d
Instruction ID: 83baa2c533de5f2f007dcbf6fac9ac7afeaf55a406d5dab3406e80f3e51e30a4
Opcode Fuzzy Hash: 292d0802afc3662b8a44df9434c69ee7ab1bc2423aa3cf29da608adeab93335d
Instruction Fuzzy Hash: 5E212F2251CEC181DAA0DB11E4513ABA7E1FB99B94F945535F7CEC3A9ADF2CD2448B00

Function 00007FF617E7BBF0 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF617E7BC1C

Part of subcall function 00007FF617E7F7D0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF617E7F846
Part of subcall function 00007FF617E7F7D0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF617E7F855

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_$Concurrency::details::EmptyQueue::StructuredWork
String ID:
API String ID: 2595383736-0
Opcode ID: d187d2a0eb802e6f176a8c328b985804572825bb7962f1620d6111e602d056cd
Instruction ID: 40d279cdcc41c451d9b78d0c73e937d952d444f22c90d12b8c2c0622c7661533
Opcode Fuzzy Hash: d187d2a0eb802e6f176a8c328b985804572825bb7962f1620d6111e602d056cd
Instruction Fuzzy Hash: A7210336618F8981DA10DB15F48125BB7A5FBC9B94F501126FA8D83B6ADF3CD150CB40

Function 00007FF617E78750 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF617E7875E

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork
String ID:
API String ID: 1865873047-0
Opcode ID: f8c7e8331dde7540c220ec2cf53b80f18e0f368c2e7c04878d69dbed098d0d54
Instruction ID: 2784f948be718de423fb134cd97afd922346f52dff12ea3d9504c5c1777eddb6
Opcode Fuzzy Hash: f8c7e8331dde7540c220ec2cf53b80f18e0f368c2e7c04878d69dbed098d0d54
Instruction Fuzzy Hash: 7A117236619F8881DB609B1AE49031EB7A1F7C9F94F505126EBCD87B6ACF3CC5508B00

Function 00007FF617E7BAA0 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF617E7BB70: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF617E7BB7E

_Byte_length.LIBCPMTD ref: 00007FF617E7BB26

Part of subcall function 00007FF617E7BBF0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF617E7BC1C

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID: Byte_lengthConcurrency::details::Concurrency::details::_CriticalEmptyLock::_Queue::ReentrantScoped_lockScoped_lock::~_StructuredWork
String ID:
API String ID: 3730899627-0
Opcode ID: 44c7796c75c25c5c7709d50e7aab81eaeec602659a9d168cd4e954b65d0e7a9e
Instruction ID: 1ddf0c13802f4c8231ebb1528851b1c0122918c2ac2d36cd361ebc842e925148
Opcode Fuzzy Hash: 44c7796c75c25c5c7709d50e7aab81eaeec602659a9d168cd4e954b65d0e7a9e
Instruction Fuzzy Hash: 3F11F222528F8582DA50DB25F49119BB7A0FBC5B90FA00122FBCD83B6ADF3CD5118F80

Function 00007FF617E7B970 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_Byte_length.LIBCPMTD ref: 00007FF617E7B9F6

Part of subcall function 00007FF617E7BBF0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF617E7BC1C

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID: Byte_lengthConcurrency::details::EmptyQueue::StructuredWork
String ID:
API String ID: 2180140624-0
Opcode ID: 3d721e314f6597f4f5539cc87ca23b51fab7460f1361a429639f5c59ef1ee461
Instruction ID: 78cb0204200091120f156edfa2a721407b27eb700783e403c2dc9957829bae66
Opcode Fuzzy Hash: 3d721e314f6597f4f5539cc87ca23b51fab7460f1361a429639f5c59ef1ee461
Instruction Fuzzy Hash: 1C11E02252CE8182DA50DB25F49119BB7A4FBC5B90FA00122FBCD83B6ADF3CD151CB40

Function 00007FF617E67E40 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF617E67E74

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork
String ID:
API String ID: 1865873047-0
Opcode ID: 30fd8099ffd4be0d4f69dd9a583985dde0d8b0850e5991a20b1c7c05a0df383f
Instruction ID: c5a07bf0607ff7ec47b5a279878d746e80baf829f06b9e6d975943adcb94477d
Opcode Fuzzy Hash: 30fd8099ffd4be0d4f69dd9a583985dde0d8b0850e5991a20b1c7c05a0df383f
Instruction Fuzzy Hash: 8C112E66618F8181DA20DB15E05036BA7A0FBC9BE4F040135FB8D87B6ACF3CD6448B40

Function 000001EF1F21ADC0 Relevance: 1.5, APIs: 1, Instructions: 38networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 000001EF1F21AE08

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: af342f55a76444dc29af71e8fb4152a83f454f5b800a0383b076c9e997804f61
Instruction ID: 505f0f48318d768731f5427b32fc2fc7da81478c4f0810f0fe67acc4e9ef208e
Opcode Fuzzy Hash: af342f55a76444dc29af71e8fb4152a83f454f5b800a0383b076c9e997804f61
Instruction Fuzzy Hash: EA01D636B18AC8C1DB509F1AF54025EA3A0FB98FD4F485135EF6D43B49DB28C8928B04

Function 00007FF617E6F6A0 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 00007FF617E6F721

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID: type_info::_name_internal_method
String ID:
API String ID: 3713626258-0
Opcode ID: 76e54cbdeb55244470ca4b8c1149c975881fede5f5229d85922bdbd701fbbbd6
Instruction ID: 23af845820ee1ead9fe3e981d5806dbb110d6464331c0c2965b5850e724048ec
Opcode Fuzzy Hash: 76e54cbdeb55244470ca4b8c1149c975881fede5f5229d85922bdbd701fbbbd6
Instruction Fuzzy Hash: FB01FA7662CF8681DA409B16F45026BB3A1FB84BD0F406431FBCD8775ADF6CE5108B40

Function 00007FF617E6CD80 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF617E6CDC2

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 5b003b8cca513f1d9bd291702dbd346b7f7ce6d2eb4d71e1a0a6965b61c62195
Instruction ID: c4a9c8afcae62db3af56882a24a2bc36d9dc7be2b33751dc86f6dfc9475c2dab
Opcode Fuzzy Hash: 5b003b8cca513f1d9bd291702dbd346b7f7ce6d2eb4d71e1a0a6965b61c62195
Instruction Fuzzy Hash: 25011662A19F8541D6609B25E44131BA7D4FB85BA8F501231F79D82BE6DF2CD6508704

Function 000001EF1F1D58F3 Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 000001EF1F1D5936

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: c09ff1b7f36846cd2f70e20038cef65db65028f9499b4e4cc306786389cb5efe
Instruction ID: eac3d2f97daba33d51fb3994fdc87d2699407efc4e7bb0d1d6a03869a9552747
Opcode Fuzzy Hash: c09ff1b7f36846cd2f70e20038cef65db65028f9499b4e4cc306786389cb5efe
Instruction Fuzzy Hash: 32014F37218AC4C1EA70CB56F85439E6364FBD9B94F804066CE9D53B59DE38C887CB00

Function 00007FF617E7C9F0 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF617E7CA33

Part of subcall function 00007FF617E6A910: allocator.LIBCONCRTD ref: 00007FF617E6A92B

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWorkallocator
String ID:
API String ID: 1755220593-0
Opcode ID: 0be8727490954b9d9608c68c0c3e94e3c05ef35cc3da3c80f663008593293bb7
Instruction ID: ff894a8450da1de5d50a362dcfa01c6b77fc6c7d4dd0878a30a95b43665a04c3
Opcode Fuzzy Hash: 0be8727490954b9d9608c68c0c3e94e3c05ef35cc3da3c80f663008593293bb7
Instruction Fuzzy Hash: 60012036619F8486CA60DB4AF89111EB7A5F7C9B94F504125FBCD83B29DF3CD6618B00

Function 000001EF1F22ED2C Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F22ED4B

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8baf8acf487f5caa78a15ef12004ef049afcc069522c3c2ef46e844b516c0117
Instruction ID: 0d5f480d37e9dc9a83c4a873a614c3921df11ed555ec9239890be27714b267a8
Opcode Fuzzy Hash: 8baf8acf487f5caa78a15ef12004ef049afcc069522c3c2ef46e844b516c0117
Instruction Fuzzy Hash: 04E09273215AC9C2EB256BA5E1413ECA1689F287B0F54473DAF34876C6DA2484D25602

Function 00007FF617EB5554 Relevance: 1.5, APIs: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF617EB5584

Part of subcall function 00007FF617EB64DC: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF617EB64E5

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: eab2c86477353e2fdf37daf347e1d7af9a32534bc8376d8c7edc6a9f128f6aaa
Instruction ID: 202e5ffa7afad49b45f036b96a18a161af9cb60595d994d5512b02afe334ea4b
Opcode Fuzzy Hash: eab2c86477353e2fdf37daf347e1d7af9a32534bc8376d8c7edc6a9f128f6aaa
Instruction Fuzzy Hash: EDE0EC40E0AF0B06F92863A5545517B06D50F4CF72E3C5730EA7ECA2D7ED1CF4954510

Function 00007FF617E7BA40 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF617E7BA6A

Part of subcall function 00007FF617E77FD0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF617E780EF
Part of subcall function 00007FF617E77FD0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF617E78197

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_
String ID:
API String ID: 2443641946-0
Opcode ID: a00cf0b1ec4db13d273557ccddcb421bc2b4e8bce47aca48317bcbe3f147d040
Instruction ID: d100bdca4eded802387fadc73a7c47a17383d5c4d875c31e0904234dbe88eb72
Opcode Fuzzy Hash: a00cf0b1ec4db13d273557ccddcb421bc2b4e8bce47aca48317bcbe3f147d040
Instruction Fuzzy Hash: 4EF07472518A8086D660EB55E45115FB7A0F7C87A4F001125FACD87B2ADF7CD6508F44

Function 000001EF1F2597D0 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 000001EF1F2597D4

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 4177796e15072c585db232ab642f29accb6d05ea1f689265af403d42f2bb1474
Instruction ID: caf8158746696eb564800f48a0aea92d2bcee1213a5c78f515c8d0813d9c7b77
Opcode Fuzzy Hash: 4177796e15072c585db232ab642f29accb6d05ea1f689265af403d42f2bb1474
Instruction Fuzzy Hash: 8CC04C26F155C9C1E6541B729C4228A1294BB77740F404139CE15C4191D92C81D74E13

Function 00007FF617E6A910 Relevance: 1.5, APIs: 1, Instructions: 9COMMONLIBRARYCODE

Download Yara Rule

APIs

allocator.LIBCONCRTD ref: 00007FF617E6A92B

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID: allocator
String ID:
API String ID: 3447690668-0
Opcode ID: 69c9719d4dd52abe98a264028dc470e26ea7d52536d19f2f10ff87e1f9baad59
Instruction ID: 83a8c9c48701239b64b339a3b602c5174fffd6d77cebef4fa547436dd984dadf
Opcode Fuzzy Hash: 69c9719d4dd52abe98a264028dc470e26ea7d52536d19f2f10ff87e1f9baad59
Instruction Fuzzy Hash: ADC0E966A29F8581CA44EB16F88101A7764F7D8BD0F90A425FA9E53729DF2CD1658B00

Function 000001EF1F25B3C4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 000001EF1F25B3CD

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 5d96549d17151685d9874b2efd5e6665c09aeaad6767ec6861ada1b691878f94
Instruction ID: ffbc00073c7d86b4daf9357ab908ce130b74a62088eabbbc9e2eb62726a32660
Opcode Fuzzy Hash: 5d96549d17151685d9874b2efd5e6665c09aeaad6767ec6861ada1b691878f94
Instruction Fuzzy Hash: B9B09236A148C0C3C611EB04E8560497331FBA6B0CFD00110EA9D42664CE2CCA2A8E00

Function 000001EF1F23DEDC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 000001EF1F23DF1A

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: ad1b43cdb7c3550550fd4afa13c905d117ea5c1f34bfd66f5f885cc22fb7391c
Instruction ID: 57b171e445f0f794d552ccda691c45e7438047869adac21573859d9896bcf766
Opcode Fuzzy Hash: ad1b43cdb7c3550550fd4afa13c905d117ea5c1f34bfd66f5f885cc22fb7391c
Instruction Fuzzy Hash: 3EF0FEB73152CDC6FA545771D8613ED22909F78760F89567C9D36862C1D968C4C38112

Function 00007FF617EA64BC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000028,00007FF617EB5573,?,?,?,00007FF617E610A8), ref: 00007FF617EA64FA

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 31f5e82480b86c694179d874989cf1b3d096565e770f3be7cb9178f83f4d8f72
Instruction ID: 7f5dc261cbaa8d27914d22c20cdfc3990e213bf7c411b3bc0d87cb42ea16654b
Opcode Fuzzy Hash: 31f5e82480b86c694179d874989cf1b3d096565e770f3be7cb9178f83f4d8f72
Instruction Fuzzy Hash: E6F08C51F0CA0789FE652772980167B13E06F86FB1F090A30DC2ECA2E7EE2CE4408A10

Function 00007FF617E626C0 Relevance: 1.3, APIs: 1, Instructions: 17memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF617E626F3

Memory Dump Source

Source File: 00000000.00000002.1491951277.00007FF617E61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF617E60000, based on PE: true

Associated: 00000000.00000002.1491932782.00007FF617E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF617ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492032274.00007FF61817D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492204407.00007FF618189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1492224787.00007FF61818C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff617e60000_unique.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bb55d3c25760e0320b4c92f21841f287c01ac31988aa5e77e6438427710fe636
Instruction ID: 2d9afc91fb588891481da5a4cd4c451dc1c43fa18bcc909c29de6a8d89755fce
Opcode Fuzzy Hash: bb55d3c25760e0320b4c92f21841f287c01ac31988aa5e77e6438427710fe636
Instruction Fuzzy Hash: 90E0C276A1CB8586DA208B15E44071BBBA4F799B94F200525EBCD82B29CF7DD6548B40

Non-executed Functions

Function 000001EF1F230D98 Relevance: 49.1, APIs: 25, Strings: 2, Instructions: 1888COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F2310CF
_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F231332
_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F2315F5
_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F231895
memcpy_s.LIBCPMT ref: 000001EF1F231AA2
memcpy_s.LIBCPMT ref: 000001EF1F231B3E
memcpy_s.LIBCPMT ref: 000001EF1F231FF6
memcpy_s.LIBCPMT ref: 000001EF1F232031
memcpy_s.LIBCPMT ref: 000001EF1F23215D
memcpy_s.LIBCPMT ref: 000001EF1F232284
memcpy_s.LIBCPMT ref: 000001EF1F23232F
memcpy_s.LIBCPMT ref: 000001EF1F232377
memcpy_s.LIBCPMT ref: 000001EF1F2323A1
memcpy_s.LIBCPMT ref: 000001EF1F232452
memcpy_s.LIBCPMT ref: 000001EF1F232652
memcpy_s.LIBCPMT ref: 000001EF1F232697
memcpy_s.LIBCPMT ref: 000001EF1F23274E
memcpy_s.LIBCPMT ref: 000001EF1F23287B
memcpy_s.LIBCPMT ref: 000001EF1F231F46

Part of subcall function 000001EF1F2331E4: _invalid_parameter_noinfo.LIBCMT ref: 000001EF1F233216

memcpy_s.LIBCPMT ref: 000001EF1F231FC1
memcpy_s.LIBCPMT ref: 000001EF1F232A35

Strings

, xrefs: 000001EF1F2327FB
, xrefs: 000001EF1F232928

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: memcpy_s$_invalid_parameter_noinfo
String ID: $
API String ID: 2880407647-227171996
Opcode ID: df87294ae73204ead43c2230939cbb6a00851c436377c9d63da8146f7a05de15
Instruction ID: e600fcecd2062334895509d6a90c62de183f4c70300d7367b5c67898eced9d41
Opcode Fuzzy Hash: df87294ae73204ead43c2230939cbb6a00851c436377c9d63da8146f7a05de15
Instruction Fuzzy Hash: 0703C2B36102C8CBE7758F25D9507EE37A1FB69788F10512ADE1697B88D735CA82CB01

Function 000001EF1F2243F0 Relevance: 34.3, APIs: 18, Strings: 1, Instructions: 1015stringmemorynativeCOMMON

Download Yara Rule

APIs

RtlAcquirePebLock.NTDLL ref: 000001EF1F224433
NtAllocateVirtualMemory.NTDLL ref: 000001EF1F22446B
lstrcpyW.KERNEL32 ref: 000001EF1F2244CD
lstrcatW.KERNEL32 ref: 000001EF1F224582
NtAllocateVirtualMemory.NTDLL ref: 000001EF1F224609
lstrcpyW.KERNEL32 ref: 000001EF1F2246BC
RtlInitUnicodeString.NTDLL ref: 000001EF1F2246D1
RtlInitUnicodeString.NTDLL ref: 000001EF1F2246E6
LdrEnumerateLoadedModules.NTDLL ref: 000001EF1F2246F9
RtlReleasePebLock.NTDLL ref: 000001EF1F2246FF

Part of subcall function 000001EF1F218E10: SHGetKnownFolderPath.SHELL32 ref: 000001EF1F218E69
Part of subcall function 000001EF1F218E10: CoTaskMemFree.OLE32 ref: 000001EF1F218F2A

CoInitializeEx.OLE32 ref: 000001EF1F2247AA
lstrcpyW.KERNEL32 ref: 000001EF1F224989
lstrcatW.KERNEL32 ref: 000001EF1F224B8E
CoGetObject.OLE32 ref: 000001EF1F224BAC
lstrcpyW.KERNEL32 ref: 000001EF1F225229
lstrcatW.KERNEL32 ref: 000001EF1F22544C
CoGetObject.OLE32 ref: 000001EF1F22546A
CoUninitialize.OLE32 ref: 000001EF1F225932

Strings

0, xrefs: 000001EF1F22506A

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AllocateInitLockMemoryObjectStringUnicodeVirtual$AcquireEnumerateFolderFreeInitializeKnownLoadedModulesPathReleaseTaskUninitialize
String ID: 0
API String ID: 1424456515-4108050209
Opcode ID: 871c8db82c018933de821c7e5ee4dab024f04bf961e7293322aa2c5c5a8db519
Instruction ID: af562f2879bee8244d5418662cc7524ad0da6aa407cff6d910ae30c37f965da4
Opcode Fuzzy Hash: 871c8db82c018933de821c7e5ee4dab024f04bf961e7293322aa2c5c5a8db519
Instruction Fuzzy Hash: 06C2A736626FC88AD7908F69E88169DB3B5F788B88F105219EECD57B18EF38C155C740

Function 000001EF1F1A6180 Relevance: 30.2, Strings: 24, Instructions: 238COMMON

Download Yara Rule

Strings

autorun.inf, xrefs: 000001EF1F1A61A8
indexervolumeguid, xrefs: 000001EF1F1A6473
iconcache.db, xrefs: 000001EF1F1A62DE
bootsect.bak, xrefs: 000001EF1F1A6246
bootstat.dat, xrefs: 000001EF1F1A6415
ntuser.ini, xrefs: 000001EF1F1A6359
winsipolicy.p7b, xrefs: 000001EF1F1A62B8
ntldr, xrefs: 000001EF1F1A6292
mib.bin, xrefs: 000001EF1F1A6444
bootmgr, xrefs: 000001EF1F1A655E
boot.sdi, xrefs: 000001EF1F1A64D1
winre.wim, xrefs: 000001EF1F1A6500
gdipfontcachev1.dat, xrefs: 000001EF1F1A63B7
thumbs.db, xrefs: 000001EF1F1A6388
boot.ini, xrefs: 000001EF1F1A61D1
desktop.ini, xrefs: 000001EF1F1A626C
bootfont.bin, xrefs: 000001EF1F1A6220
reagent.xml, xrefs: 000001EF1F1A652F
ntuser.dat, xrefs: 000001EF1F1A6304
BOOTNXT, xrefs: 000001EF1F1A658D
d3d9caps.dat, xrefs: 000001EF1F1A63E6
bootmgfw.efi, xrefs: 000001EF1F1A61F9
ntuser.dat.log, xrefs: 000001EF1F1A632D
wpsettings.dat, xrefs: 000001EF1F1A64A2

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: BOOTNXT$autorun.inf$boot.ini$boot.sdi$bootfont.bin$bootmgfw.efi$bootmgr$bootsect.bak$bootstat.dat$d3d9caps.dat$desktop.ini$gdipfontcachev1.dat$iconcache.db$indexervolumeguid$mib.bin$ntldr$ntuser.dat$ntuser.dat.log$ntuser.ini$reagent.xml$thumbs.db$winre.wim$winsipolicy.p7b$wpsettings.dat
API String ID: 118556049-850610325
Opcode ID: dea6d34053270f54165e7821960ee4cc20a6cc02140d0cf59d37aac2e2ba149c
Instruction ID: da98d6b52c7ecf41fe631e2031d652f486ba7ff6d1a9401f6954b046a17a023d
Opcode Fuzzy Hash: dea6d34053270f54165e7821960ee4cc20a6cc02140d0cf59d37aac2e2ba149c
Instruction Fuzzy Hash: 7AC14473D60BCD84E721DB35DC923E95321FBFA384F60631A6D8865856EBA4A3C5C340

Function 000001EF1F1EC820 Relevance: 29.3, APIs: 2, Strings: 14, Instructions: 1339COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F1EDEA1
Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F1EDF4F

Part of subcall function 000001EF1F1CB930: __std_exception_copy.LIBVCRUNTIME ref: 000001EF1F1CB973

Part of subcall function 000001EF1F24F198: RtlPcToFileHeader.KERNEL32 ref: 000001EF1F24F1E8
Part of subcall function 000001EF1F24F198: RaiseException.KERNEL32 ref: 000001EF1F24F229

Strings

key declared, but no value, xrefs: 000001EF1F1EDDED, 000001EF1F1EDE14, 000001EF1F1EDF01
*, xrefs: 000001EF1F1ECB3D
quote was opened but not closed., xrefs: 000001EF1F1EDDC6, 000001EF1F1EDE3B
unexpected '}', xrefs: 000001EF1F1EDF7C
unexpected key without object, xrefs: 000001EF1F1EDE7A
object is not closed with '}', xrefs: 000001EF1F1EDD9F
key opened, but never closed, xrefs: 000001EF1F1EDF28
#include, xrefs: 000001EF1F1ED1F9
", xrefs: 000001EF1F1ECD13
word wasnt properly ended, xrefs: 000001EF1F1EDF55
#base, xrefs: 000001EF1F1ED225
/, xrefs: 000001EF1F1ECB12
No closed word, xrefs: 000001EF1F1EDEA7, 000001EF1F1EDECE
Unexpected eof, xrefs: 000001EF1F1EDD72

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$ExceptionFileHeaderRaise__std_exception_copy
String ID: "$#base$#include$*$/$No closed word$Unexpected eof$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 145623376-3561477107
Opcode ID: e1fb44af09d5265b52bc700c18f1e0b665796307b88a6a3ec42f7556474d5ffc
Instruction ID: 048b259fddfe9f77155632718d2a65920daf42cac04ff01c2ba965193f79f206
Opcode Fuzzy Hash: e1fb44af09d5265b52bc700c18f1e0b665796307b88a6a3ec42f7556474d5ffc
Instruction Fuzzy Hash: A8D25D73201AC8C9EB619F24D8543DD33A1FB65798F84412ADE5E2BA9ADF74C6C6D300

Function 000001EF1F1A5DB0 Relevance: 25.2, Strings: 20, Instructions: 202COMMON

Download Yara Rule

Strings

Boot, xrefs: 000001EF1F1A5E50
$winreagent, xrefs: 000001EF1F1A5F5D
PerfLogs, xrefs: 000001EF1F1A5F34
$windows.~ws, xrefs: 000001EF1F1A5F89
AppData, xrefs: 000001EF1F1A5FE7
All users, xrefs: 000001EF1F1A6074
$recycle.bin, xrefs: 000001EF1F1A5DD8
ntldr, xrefs: 000001EF1F1A6016
$windows.~bt, xrefs: 000001EF1F1A5F0E
bootmgr, xrefs: 000001EF1F1A60A3
Windows, xrefs: 000001EF1F1A5E01
System Volume Information, xrefs: 000001EF1F1A5E76
#recycle, xrefs: 000001EF1F1A5E29
Windows.~bt, xrefs: 000001EF1F1A5FB8
Application Data, xrefs: 000001EF1F1A5E9C
Windows.old, xrefs: 000001EF1F1A5EE8
Program Files, xrefs: 000001EF1F1A60D2
config.msi, xrefs: 000001EF1F1A5EC2
Program Files (x86), xrefs: 000001EF1F1A6101
ProgramData, xrefs: 000001EF1F1A6045

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: #recycle$$recycle.bin$$windows.~bt$$windows.~ws$$winreagent$All users$AppData$Application Data$Boot$PerfLogs$Program Files$Program Files (x86)$ProgramData$System Volume Information$Windows$Windows.old$Windows.~bt$bootmgr$config.msi$ntldr
API String ID: 118556049-2722463023
Opcode ID: b349f0743e28fad41dd0cf6d04c419ecc5bc303b8eb5692233894048f4044c83
Instruction ID: 7e9804365856d5c82752382b507436f94f22eef707c6d8ebc385e967055a85f8
Opcode Fuzzy Hash: b349f0743e28fad41dd0cf6d04c419ecc5bc303b8eb5692233894048f4044c83
Instruction Fuzzy Hash: 2BA14573D60FDD84E711DB35DC823E95321FBFA388F60631AAD9866856EB64A2C5C340

Function 000001EF1F1EE320 Relevance: 24.1, APIs: 2, Strings: 11, Instructions: 1388COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F1EFA31
Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F1EFB06

Strings

key declared, but no value, xrefs: 000001EF1F1EF97D, 000001EF1F1EF9A4, 000001EF1F1EFAB8
word wasnt properly ended, xrefs: 000001EF1F1EFA85, 000001EF1F1EFB0C
#base, xrefs: 000001EF1F1EEDB6
quote was opened but not closed., xrefs: 000001EF1F1EF956, 000001EF1F1EF9CB
unexpected '}', xrefs: 000001EF1F1EFB33
unexpected key without object, xrefs: 000001EF1F1EFA0A
object is not closed with '}', xrefs: 000001EF1F1EF92F
key opened, but never closed, xrefs: 000001EF1F1EFADF
#include, xrefs: 000001EF1F1EED8A
No closed word, xrefs: 000001EF1F1EFA37, 000001EF1F1EFA5E
Unexpected eof, xrefs: 000001EF1F1EF902

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: #base$#include$No closed word$Unexpected eof$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 118556049-1838291449
Opcode ID: 680b7df58fea4b095c02cd41ffb0843881cef1913b656ad0361896acb1ddca19
Instruction ID: 8202ca398a49f1fb41b13db5d2e67970eb4307a4ed463ffc27c79c901973aa8c
Opcode Fuzzy Hash: 680b7df58fea4b095c02cd41ffb0843881cef1913b656ad0361896acb1ddca19
Instruction Fuzzy Hash: 4CE25B73201BC8C9EB718F24D8543ED23A1EB65B98F45412ADE5E1BA9ADF74C6C6D300

Function 000001EF1F223CF0 Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 351nativelibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 000001EF1F223D36
GetProcAddress.KERNEL32 ref: 000001EF1F223D46
OpenProcess.KERNEL32 ref: 000001EF1F223D78
NtQuerySystemInformation.NTDLL ref: 000001EF1F223DA0
NtQuerySystemInformation.NTDLL ref: 000001EF1F223DCE
GetCurrentProcess.KERNEL32 ref: 000001EF1F223E93
NtQueryObject.NTDLL ref: 000001EF1F223ED9
GetFinalPathNameByHandleA.KERNEL32 ref: 000001EF1F223FCD
CloseHandle.KERNEL32 ref: 000001EF1F2240E8
CloseHandle.KERNEL32 ref: 000001EF1F224178

Strings

ntdll.dll, xrefs: 000001EF1F223D2F
File, xrefs: 000001EF1F223F0A
NtDuplicateObject, xrefs: 000001EF1F223D3F

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Handle$Query$CloseInformationProcessSystem$AddressCurrentFinalModuleNameObjectOpenPathProc
String ID: File$NtDuplicateObject$ntdll.dll
API String ID: 2729825427-3955674919
Opcode ID: 29b8755b41df6b2d885039064fcf97b48faa31fbfe035c7d26f92b0c8bdecf9b
Instruction ID: 28f18f63aa91fb4f4667f2f5bd8a656f26d5b41e612ae4a4b77e22c4e8880de7
Opcode Fuzzy Hash: 29b8755b41df6b2d885039064fcf97b48faa31fbfe035c7d26f92b0c8bdecf9b
Instruction Fuzzy Hash: 9CE1B273714AC8C9FB00CBA5D4103ED27B1EB65B88F408129DE6D97B9ADF78C58A8301

Function 000001EF1F20F040 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 218COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32 ref: 000001EF1F20F09F

Strings

@, xrefs: 000001EF1F20F226

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Initialize
String ID: @
API String ID: 2538663250-2766056989
Opcode ID: 51a3142d8d5f26322b3a8525074c9bde09a9fc806b8d02ebc27a6b845aabe09a
Instruction ID: ef3cae129e68b433e3b18562f8fd68de11d8ad9c86ad1afbfc5abe823ea9f88c
Opcode Fuzzy Hash: 51a3142d8d5f26322b3a8525074c9bde09a9fc806b8d02ebc27a6b845aabe09a
Instruction Fuzzy Hash: D5A18973B04AC8CAE710CF64E40079D77B1FBA9B98F004229DE6A57A98DB39C1968745

Function 000001EF1F2486F0 Relevance: 22.2, APIs: 8, Strings: 4, Instructions: 1156COMMON

Download Yara Rule

Strings

s, xrefs: 000001EF1F2497FA
j%, xrefs: 000001EF1F24872D
?$, xrefs: 000001EF1F248858
s, xrefs: 000001EF1F249719

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: s$s$?$$j%
API String ID: 3215553584-1997487030
Opcode ID: d7f83457da4c3e3b32f3b759ac70e557949627dbed151290640d8c5a3e20f7d8
Instruction ID: 5496c22491b160ddcffa9e6340a839477dbc05a89af6bce2556981e4141556e6
Opcode Fuzzy Hash: d7f83457da4c3e3b32f3b759ac70e557949627dbed151290640d8c5a3e20f7d8
Instruction Fuzzy Hash: 4DA2D2737142D8CBE725CF64D440BED37A1FB74788F405129DE2A67A88D7B49A82CB41

Function 000001EF1F2151E0 Relevance: 21.5, APIs: 1, Strings: 11, Instructions: 465COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32 ref: 000001EF1F215767

Strings

ios_base::eofbit set, xrefs: 000001EF1F21598C
.exe, xrefs: 000001EF1F215245
.vbs, xrefs: 000001EF1F2152D2
ios_base::badbit set, xrefs: 000001EF1F21597A
.exe, xrefs: 000001EF1F21532D
ios_base::failbit set, xrefs: 000001EF1F215985
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;', xrefs: 000001EF1F215374
runas, xrefs: 000001EF1F2156E6
.ps1, xrefs: 000001EF1F215274
open, xrefs: 000001EF1F2156DD
.cmd, xrefs: 000001EF1F2152A3

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: .cmd$.exe$.exe$.ps1$.vbs$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;'$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$open$runas
API String ID: 587946157-4093014531
Opcode ID: ddd4c35cac104fd5c0bc8725230d3c325b14ca8019773d0ba1a3df29e84f68a2
Instruction ID: 96fa5cb35e6048698441acac6e5fe5f36d1e9242673bcf2ffb1a1f27d393de52
Opcode Fuzzy Hash: ddd4c35cac104fd5c0bc8725230d3c325b14ca8019773d0ba1a3df29e84f68a2
Instruction Fuzzy Hash: 0E22B173A10BC8C5EB10DF28E8813DD27A1FB94798F50522AEE6D47AA9DB74C1C6C741

Function 000001EF1F224740 Relevance: 16.6, APIs: 8, Strings: 1, Instructions: 839stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000001EF1F2243F0: RtlAcquirePebLock.NTDLL ref: 000001EF1F224433
Part of subcall function 000001EF1F2243F0: NtAllocateVirtualMemory.NTDLL ref: 000001EF1F22446B
Part of subcall function 000001EF1F2243F0: lstrcpyW.KERNEL32 ref: 000001EF1F2244CD
Part of subcall function 000001EF1F2243F0: lstrcatW.KERNEL32 ref: 000001EF1F224582

CoInitializeEx.OLE32 ref: 000001EF1F2247AA
lstrcpyW.KERNEL32 ref: 000001EF1F224989
lstrcatW.KERNEL32 ref: 000001EF1F224B8E
CoGetObject.OLE32 ref: 000001EF1F224BAC
lstrcpyW.KERNEL32 ref: 000001EF1F225229
lstrcatW.KERNEL32 ref: 000001EF1F22544C
CoGetObject.OLE32 ref: 000001EF1F22546A
CoUninitialize.OLE32 ref: 000001EF1F225932

Strings

0, xrefs: 000001EF1F22506A

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: lstrcatlstrcpy$Object$AcquireAllocateInitializeLockMemoryUninitializeVirtual
String ID: 0
API String ID: 3636535045-4108050209
Opcode ID: 148f1cac526a25eedb59746f716de0c0cfa115320cfb54a3382c2084b1ee678e
Instruction ID: 0f4812ccd71731dd72ec1ea35c3555f6b6ce3a3516ec20f81631f3ce5e16b03d
Opcode Fuzzy Hash: 148f1cac526a25eedb59746f716de0c0cfa115320cfb54a3382c2084b1ee678e
Instruction Fuzzy Hash: 73B2983662AFC48AD7808F69E88155EB7B5F788B88F106219FECD57B18EB38C154C740

Function 000001EF1F21AE50 Relevance: 13.2, APIs: 2, Strings: 4, Instructions: 2695COMMON

Download Yara Rule

Strings

type must be string, but is , xrefs: 000001EF1F21E3FD, 000001EF1F21E4AD, 000001EF1F21E571, 000001EF1F21E5CB
cannot use push_back() with , xrefs: 000001EF1F21E393
cannot compare iterators of different containers, xrefs: 000001EF1F21E43F, 000001EF1F21E4EF, 000001EF1F21E61F
value, xrefs: 000001EF1F21B688

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: cannot compare iterators of different containers$cannot use push_back() with $type must be string, but is $value
API String ID: 118556049-2711811579
Opcode ID: ea88d1a773ee75e0a64725fff508dd48958dffa6bfda602257c9859f01315e0d
Instruction ID: 24864871751dc139e2c12f37f7f539b6ddafe0f81e0380833eae75c4bd49debf
Opcode Fuzzy Hash: ea88d1a773ee75e0a64725fff508dd48958dffa6bfda602257c9859f01315e0d
Instruction Fuzzy Hash: B8535B33604BC8C9DB70DF24D8903DD23A5FB65758F50962ADE6D5BA9AEF348286C301

Function 000001EF1F246F14 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001EF1F2381FC: GetLastError.KERNEL32 ref: 000001EF1F23820B
Part of subcall function 000001EF1F2381FC: FlsGetValue.KERNEL32 ref: 000001EF1F238220
Part of subcall function 000001EF1F2381FC: SetLastError.KERNEL32 ref: 000001EF1F2382AB

TranslateName.LIBCMT ref: 000001EF1F246F7E
TranslateName.LIBCMT ref: 000001EF1F246FB9
GetACP.KERNEL32 ref: 000001EF1F247000
IsValidCodePage.KERNEL32 ref: 000001EF1F247038
GetLocaleInfoW.KERNEL32 ref: 000001EF1F2471F5

Strings

utf8, xrefs: 000001EF1F24711C

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: 4309449c26b629e9b6de698707476955217e9cbe9722d2e68f3c85218e94a805
Instruction ID: e881189ca83051078402abebdb7b804af5028f9bb464e0787003ae9a10354eff
Opcode Fuzzy Hash: 4309449c26b629e9b6de698707476955217e9cbe9722d2e68f3c85218e94a805
Instruction Fuzzy Hash: AC9199732007C8C6EB249F61D8417DD67A4EBB4B80F4481399EB987785DBB8C997C742

Function 000001EF1F24795C Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001EF1F2381FC: GetLastError.KERNEL32 ref: 000001EF1F23820B
Part of subcall function 000001EF1F2381FC: FlsGetValue.KERNEL32 ref: 000001EF1F238220
Part of subcall function 000001EF1F2381FC: SetLastError.KERNEL32 ref: 000001EF1F2382AB

Part of subcall function 000001EF1F2381FC: FlsSetValue.KERNEL32 ref: 000001EF1F238241

GetUserDefaultLCID.KERNEL32 ref: 000001EF1F247ACC

Part of subcall function 000001EF1F2381FC: FlsSetValue.KERNEL32 ref: 000001EF1F23826E
Part of subcall function 000001EF1F2381FC: FlsSetValue.KERNEL32 ref: 000001EF1F23827F
Part of subcall function 000001EF1F2381FC: FlsSetValue.KERNEL32 ref: 000001EF1F238290

EnumSystemLocalesW.KERNEL32 ref: 000001EF1F247AB3
ProcessCodePage.LIBCMT ref: 000001EF1F247AF6
IsValidCodePage.KERNEL32 ref: 000001EF1F247B08
IsValidLocale.KERNEL32 ref: 000001EF1F247B1E
GetLocaleInfoW.KERNEL32 ref: 000001EF1F247B7A
GetLocaleInfoW.KERNEL32 ref: 000001EF1F247B96

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 5eb0d27aa7dc3a9912447742f13a9ce850b1caaedf69b48f01ffc0c9247ee539
Instruction ID: 533d43b2b1e9a9473e580e5e1235c24c58f3e2ea1d85c66555115297c82eb799
Opcode Fuzzy Hash: 5eb0d27aa7dc3a9912447742f13a9ce850b1caaedf69b48f01ffc0c9247ee539
Instruction Fuzzy Hash: 1F7147337006D8CAFB109B60D8517EC33A0BF79B48F4445398E7957B95EBB88986C362

Function 000001EF1F204710 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 000001EF1F2048C4
__std_exception_destroy.LIBVCRUNTIME ref: 000001EF1F2048D2
__std_exception_destroy.LIBVCRUNTIME ref: 000001EF1F204B55
__std_exception_destroy.LIBVCRUNTIME ref: 000001EF1F204B63

Strings

value, xrefs: 000001EF1F2047EA, 000001EF1F204A83

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: 28ce3664ced69345c44a20b0c25082befce6cc779f60b6314a591e609d66e394
Instruction ID: c684bfc5e738887ba2dd31f998cad2cfce41844644c23e5eff99d68fa5e80d46
Opcode Fuzzy Hash: 28ce3664ced69345c44a20b0c25082befce6cc779f60b6314a591e609d66e394
Instruction Fuzzy Hash: 2D02B033A14BC8C5EB00CB74D4903DD6760EBA57A4F50522AFEAD43AEADB68C0C6C301

Function 000001EF1F22F920 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 000001EF1F22F999
RtlLookupFunctionEntry.KERNEL32 ref: 000001EF1F22F9B1
RtlVirtualUnwind.KERNEL32 ref: 000001EF1F22F9EC
IsDebuggerPresent.KERNEL32 ref: 000001EF1F22FA25
SetUnhandledExceptionFilter.KERNEL32 ref: 000001EF1F22FA2F
UnhandledExceptionFilter.KERNEL32 ref: 000001EF1F22FA3A

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: c7f70f128318b326f672a7b0d6647dc5eb587961ea58d1b4d09a7c2ba848fd84
Instruction ID: 09d5f55b215a5eb69078c97e6eecd224a1cdee26b588061b4fd9cfe4d35d9a4f
Opcode Fuzzy Hash: c7f70f128318b326f672a7b0d6647dc5eb587961ea58d1b4d09a7c2ba848fd84
Instruction Fuzzy Hash: 5F312F33214BC4C5DB608B25E8507DD73A4FBA5754F500229EEAD43BA9DF38C186CB01

Function 000001EF1F1D9090 Relevance: 8.4, Strings: 6, Instructions: 916COMMON

Download Yara Rule

Strings

content, xrefs: 000001EF1F1D9D62
key, xrefs: 000001EF1F1D95ED, 000001EF1F1D97CD
exists, xrefs: 000001EF1F1DA167, 000001EF1F1DA182
filename, xrefs: 000001EF1F1D9BE9
directory_iterator::directory_iterator, xrefs: 000001EF1F1DA1D4
files, xrefs: 000001EF1F1D9EE5

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID: content$directory_iterator::directory_iterator$exists$filename$files$key
API String ID: 0-2980817763
Opcode ID: 372a0f8b2676df317ff7edebaf64bc24315962dde7ff9212df00aefb89c8fef5
Instruction ID: f435949f98fbbed6047d6d07792026814f3c26872b03197ee49518885d0e9b94
Opcode Fuzzy Hash: 372a0f8b2676df317ff7edebaf64bc24315962dde7ff9212df00aefb89c8fef5
Instruction Fuzzy Hash: FBA25A73611BC889DB218F24D8943DD33A5FBA9758F504629EEAD1BB99EF74C281C340

Function 000001EF1F1D7B8D Relevance: 7.4, Strings: 5, Instructions: 1142COMMON

Download Yara Rule

Strings

content, xrefs: 000001EF1F1D7E5F, 000001EF1F1D81E7, 000001EF1F1D8B04
filename, xrefs: 000001EF1F1D7E06, 000001EF1F1D818E, 000001EF1F1D8A22
status, xrefs: 000001EF1F1D9027
config, xrefs: 000001EF1F1D7F9D
users, xrefs: 000001EF1F1D8522

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID: config$content$filename$status$users
API String ID: 0-2677590375
Opcode ID: 0ead2873f2b42795492d5873a47f0c2e82fdfbe96deb9bd760e1f33f126642a8
Instruction ID: a70ae6a2314306e00dceb6f79df4248d997e64ab6cc587533dce81f0ee80cf96
Opcode Fuzzy Hash: 0ead2873f2b42795492d5873a47f0c2e82fdfbe96deb9bd760e1f33f126642a8
Instruction Fuzzy Hash: 68C26E73611BC889DB31DF24D8943DD2361FBA5798F40522ADE9D5BA9AEF34C686C300

Function 000001EF1F25BB14 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001EF1F25BB75
IsDebuggerPresent.KERNEL32 ref: 000001EF1F25BB8D
OutputDebugStringW.KERNEL32 ref: 000001EF1F25BB9E

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 000001EF1F25BB97

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: e8ffe009acab376759065dd43441e42d099b308a5e20a56206d0bc25ee25ae09
Instruction ID: 9fbe319afb17e4bcd80e4db9691489f551fe0b9068ad5a9ad401bd4b72c3cfd6
Opcode Fuzzy Hash: e8ffe009acab376759065dd43441e42d099b308a5e20a56206d0bc25ee25ae09
Instruction Fuzzy Hash: CD113D33210BC8D7E7149B26D6943ED32A0FB65344F544129CE6982AA5EF78D0E5CB12

Function 000001EF1F1D02E0 Relevance: 7.0, Strings: 5, Instructions: 747COMMON

Download Yara Rule

Strings

content, xrefs: 000001EF1F1D0946
exists, xrefs: 000001EF1F1D0F26
filename, xrefs: 000001EF1F1D088E
status, xrefs: 000001EF1F1D0F58, 000001EF1F1D0F6E
directory_iterator::directory_iterator, xrefs: 000001EF1F1D0F42, 000001EF1F1D0F92

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: __std_fs_convert_wide_to_narrow$__std_fs_code_page
String ID: content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 3645842244-3429737954
Opcode ID: 54f852f075973074e8b36a464f45daae2d147409958a63309f7fac4ff7c5b95c
Instruction ID: 78e34e90c51d28344e38ad2e5e1d6551d5de054af8f836fce26c88693c0f395d
Opcode Fuzzy Hash: 54f852f075973074e8b36a464f45daae2d147409958a63309f7fac4ff7c5b95c
Instruction Fuzzy Hash: 33728E33601BC8C9EB219F34D8843DD6360FBA9798F545229DE9D57AA9EF74C686C300

Function 000001EF1F248777 Relevance: 6.4, Strings: 5, Instructions: 198COMMON

Download Yara Rule

Strings

1#SNAN, xrefs: 000001EF1F2487EA
1#IND, xrefs: 000001EF1F2487C7
?$, xrefs: 000001EF1F248858
1#INF, xrefs: 000001EF1F248803
1#QNAN, xrefs: 000001EF1F2487F3

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: 1#IND$1#INF$1#QNAN$1#SNAN$?$
API String ID: 3215553584-1387705338
Opcode ID: 5bfe81fbe56545cd112a2c5bf7b1515692a0682ac3cc98352d19caed2fd731ff
Instruction ID: 217fa09ad910af7c8132ed5fde3d28f243e8d1a362e3ecbc21e52025ad696686
Opcode Fuzzy Hash: 5bfe81fbe56545cd112a2c5bf7b1515692a0682ac3cc98352d19caed2fd731ff
Instruction Fuzzy Hash: 5F71F373B242C9C6E725CF68D4407ED7791BBB4394F0046399E269AAC4D6F8D982CA02

Function 000001EF1F237348 Relevance: 6.1, APIs: 4, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 000001EF1F23739F
GetSystemInfo.KERNEL32 ref: 000001EF1F2373B8
VirtualAlloc.KERNEL32 ref: 000001EF1F237426
VirtualProtect.KERNEL32 ref: 000001EF1F237441

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: 324fd5cd604fef47d1152131e1f7c01459585a6c12e9a2e3e67a5e0172bc20d3
Instruction ID: 707b96550c8c3e6bd177b3e5c384c5ab1e603283039a0329b3fea49ca5d0531d
Opcode Fuzzy Hash: 324fd5cd604fef47d1152131e1f7c01459585a6c12e9a2e3e67a5e0172bc20d3
Instruction Fuzzy Hash: 63313532310AC8DEDB20CF35D8547DC23A5FB59B98F85412AEE6987B58DB38D686C701

Function 000001EF1F24DC18 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001EF1F24DC44
GetCurrentThreadId.KERNEL32 ref: 000001EF1F24DC52
GetCurrentProcessId.KERNEL32 ref: 000001EF1F24DC5E
QueryPerformanceCounter.KERNEL32 ref: 000001EF1F24DC6E

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: f06392d29159ea5021ae0933302a5494cfde722d0989828b5d6bd782ea4d1856
Instruction ID: c86a513e2c009b9b2cca36f9f778bd05c89241a6b8b14d0a35771c8df41af35a
Opcode Fuzzy Hash: f06392d29159ea5021ae0933302a5494cfde722d0989828b5d6bd782ea4d1856
Instruction Fuzzy Hash: A8110A32711B848AEB00CB60E8543A833A4F76A758F440A25EE6D467A4DF78D1968241

Function 000001EF1F208950 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 376COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001EF1F208BAE

Strings

parse_error, xrefs: 000001EF1F2089DE
value, xrefs: 000001EF1F2098D3

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: __std_exception_copy
String ID: parse_error$value
API String ID: 592178966-1739288027
Opcode ID: 4851d699a5fe3ee1621fabd9ca858f3f45b2256afb1c17ab6489a68ee2915630
Instruction ID: faaa8f1cba6d6b062748ecdbae38e9cb149cd952cadd3d73285018ad29b50827
Opcode Fuzzy Hash: 4851d699a5fe3ee1621fabd9ca858f3f45b2256afb1c17ab6489a68ee2915630
Instruction Fuzzy Hash: 7CF1A373710AC8D5EB00DF74D8513DD2362FBA5398F90522AAE6C57A9ADBB4C1C6C341

Function 000001EF1F1DA1F0 Relevance: 5.6, Strings: 4, Instructions: 609COMMON

Download Yara Rule

Strings

content, xrefs: 000001EF1F1DA94F
exists, xrefs: 000001EF1F1DAC67
filename, xrefs: 000001EF1F1DA7A9
directory_iterator::directory_iterator, xrefs: 000001EF1F1DAC83

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID: content$directory_iterator::directory_iterator$exists$filename
API String ID: 0-1400943384
Opcode ID: 8cdcfcabf416a846f8b709d67d1ed5e4de1a3e15bb52bcf2c0d2cb9766d0ef1a
Instruction ID: a581f2cd40785bdf0a1d6878f22245efad7b0ca202412ac5c2943fdb27d2d9a9
Opcode Fuzzy Hash: 8cdcfcabf416a846f8b709d67d1ed5e4de1a3e15bb52bcf2c0d2cb9766d0ef1a
Instruction Fuzzy Hash: EB525A73611BC8CAEB20CF29E8443DD63A1FB95798F405229EE9D57B99EB74C582C700

Function 000001EF1F22B68A Relevance: 5.6, Strings: 4, Instructions: 563COMMON

Download Yara Rule

Strings

object, xrefs: 000001EF1F22BE66
array, xrefs: 000001EF1F22BDAE
object key, xrefs: 000001EF1F22BC80, 000001EF1F22BFD6
object separator, xrefs: 000001EF1F22BBD4, 000001EF1F22BF1E

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: array$object$object key$object separator
API String ID: 2453523683-2277530871
Opcode ID: ff9f8e2d7a503b8ed2932d8375cdb56464cfdfd71d6bfc1e017697cb417a1a11
Instruction ID: 722ceb731c91ac1dcd501a3a888315bcc2704cc6c26408a811345764376235e6
Opcode Fuzzy Hash: ff9f8e2d7a503b8ed2932d8375cdb56464cfdfd71d6bfc1e017697cb417a1a11
Instruction Fuzzy Hash: AF32B033624AC8D6EB00DF74C4913ED2361FFB5784F80262AEE595769AEB64C286C741

Function 000001EF1F2419B8 Relevance: 5.5, APIs: 3, Instructions: 1005COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F241DEE
_get_daylight.LIBCMT ref: 000001EF1F241E89
_get_daylight.LIBCMT ref: 000001EF1F241EA2

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: 3362572290862af57679fdc4baef7ebaaf60df3fe4e64099d27ff34f0326e21c
Instruction ID: 66b073e7a5b03e99ac93d34c5c081fc01916f1fdab57ec7bbc58e6babcda27db
Opcode Fuzzy Hash: 3362572290862af57679fdc4baef7ebaaf60df3fe4e64099d27ff34f0326e21c
Instruction Fuzzy Hash: 9892CF332047C8C6E7658F65D9502AD37A1FF76788F248129DF9907B98DBB8C992C702

Function 000001EF1F208F53 Relevance: 5.4, Strings: 4, Instructions: 408COMMON

Download Yara Rule

Strings

object, xrefs: 000001EF1F2094D9
array, xrefs: 000001EF1F209424
object key, xrefs: 000001EF1F209643
object separator, xrefs: 000001EF1F20958E

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID: array$object$object key$object separator
API String ID: 0-2277530871
Opcode ID: 983b4e23c340c712356940ba6535c820086c6c5144e5b99ac71a0b9a66a45a14
Instruction ID: efa10247247f816e56b4a1d6f45c870b14b396d66fb8369f9ba1bd4047a57c5f
Opcode Fuzzy Hash: 983b4e23c340c712356940ba6535c820086c6c5144e5b99ac71a0b9a66a45a14
Instruction Fuzzy Hash: AB02D173624ACCD6EB10DB34C4553ED2322FBA5784F80122AEE5E57A9ADF65C2C6C341

Function 000001EF1F232CD0 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 000001EF1F232D36
memcpy_s.LIBCPMT ref: 000001EF1F232D61

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: e899307af8ea146bffc4d3d3e4071cf966dfaa801a3502f7d3bb1face14528cf
Instruction ID: 606affe88bf0cc1ce725a600eacc0d44f4f073518344c698e7870d442340976a
Opcode Fuzzy Hash: e899307af8ea146bffc4d3d3e4071cf966dfaa801a3502f7d3bb1face14528cf
Instruction Fuzzy Hash: 9DC1D3B37146C8C7EB24CF19E0447AEB7A1F7A9B84F448129DF5A47784D639E982CB40

Function 000001EF1F2473D8 Relevance: 4.7, APIs: 3, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 000001EF1F2381FC: GetLastError.KERNEL32 ref: 000001EF1F23820B
Part of subcall function 000001EF1F2381FC: FlsGetValue.KERNEL32 ref: 000001EF1F238220
Part of subcall function 000001EF1F2381FC: SetLastError.KERNEL32 ref: 000001EF1F2382AB

Part of subcall function 000001EF1F2381FC: FlsSetValue.KERNEL32 ref: 000001EF1F238241

GetLocaleInfoW.KERNEL32 ref: 000001EF1F247444

Part of subcall function 000001EF1F22DEA0: _invalid_parameter_noinfo.LIBCMT ref: 000001EF1F22DEBD

GetLocaleInfoW.KERNEL32 ref: 000001EF1F24748D

Part of subcall function 000001EF1F22DEA0: _invalid_parameter_noinfo.LIBCMT ref: 000001EF1F22DF16

GetLocaleInfoW.KERNEL32 ref: 000001EF1F247555

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
String ID:
API String ID: 1791019856-0
Opcode ID: 90d945be40b20d5b5a3c3d7ca8cbaa30e5ffd7f5627642ea07c20393f480da84
Instruction ID: d2e394694fa30e9fd4999cd68260abfaef6ff7295e30e60119d6df50411ab44e
Opcode Fuzzy Hash: 90d945be40b20d5b5a3c3d7ca8cbaa30e5ffd7f5627642ea07c20393f480da84
Instruction Fuzzy Hash: DD615C732006C9C6EB349F11E5903ED63A1FBB4744F448139CFBA9B691DAB8D492CB42

Function 000001EF1F2106A6 Relevance: 4.4, Strings: 3, Instructions: 653COMMON

Download Yara Rule

Strings

rXwr2/Mp0kvTmn+hdCWeFmDWltFpcKXkn/UOvH+3cNE=, xrefs: 000001EF1F210749
2OWqJZldB3s=, xrefs: 000001EF1F2107D1
port, xrefs: 000001EF1F21135F

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID: 2OWqJZldB3s=$port$rXwr2/Mp0kvTmn+hdCWeFmDWltFpcKXkn/UOvH+3cNE=
API String ID: 0-1454942929
Opcode ID: 13142f87b2511d2cf5765ed835205468a3a3f595768c387b348a2c7557cc377c
Instruction ID: 7276b68adb930684e2ee421b9c233542df0fb40b0d6faddc4ab12dcb97a59dbe
Opcode Fuzzy Hash: 13142f87b2511d2cf5765ed835205468a3a3f595768c387b348a2c7557cc377c
Instruction Fuzzy Hash: 93724F73A29BC885D660CB25E4403DEA3A4FBE9784F505229EFDD53B59EB38C185CB04

Function 000001EF1F1D6130 Relevance: 3.9, Strings: 2, Instructions: 1357COMMON

Download Yara Rule

Strings

exists, xrefs: 000001EF1F1D7701
Software, xrefs: 000001EF1F1D65AD, 000001EF1F1D677B

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID: Software$exists
API String ID: 0-2364128853
Opcode ID: bb1535ce0510b26616edaa2cdd06f56ed1262f790a8e31855c2113042d70fe95
Instruction ID: e91ca087a75e218dcf0fb9402087c86f58a500a96b9b530c165efe58f5dcaa09
Opcode Fuzzy Hash: bb1535ce0510b26616edaa2cdd06f56ed1262f790a8e31855c2113042d70fe95
Instruction Fuzzy Hash: 78D26E73A10BC8C9EB218F29D8543DD63B0FBA9798F105629EE9D57B99DB74C582C300

Function 000001EF1F1EE130 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 310COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F1EE314

Strings

conditional not closed, xrefs: 000001EF1F1EE2CE, 000001EF1F1EE2F1

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: conditional not closed
API String ID: 118556049-2481790218
Opcode ID: 6badf6fec46ba2b691236dfdb1554856c9d1a8cc0d10f8e91f431355c325565f
Instruction ID: eec0f10a795329bfd9a1271b1665f7d38a48120aa3dcb3a0bdd0327994c47014
Opcode Fuzzy Hash: 6badf6fec46ba2b691236dfdb1554856c9d1a8cc0d10f8e91f431355c325565f
Instruction Fuzzy Hash: 6BD16D73601BC8C4EB22CF20E8403ED77A5FB69784F55412ADE9917A9ADB78C6D2D700

Function 000001EF1F23C1A8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 000001EF1F23C21C

Strings

GetLocaleInfoEx, xrefs: 000001EF1F23C1C4, 000001EF1F23C1D5

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 0fc81d44bec917c2802c26d4724ac6a513cb7d03bb6cf24fcfbb40603345bdc0
Instruction ID: 3c8a0c4b2a86483e5310942ee682e1238243f7a2fecf1132fac0f8dccaa383e2
Opcode Fuzzy Hash: 0fc81d44bec917c2802c26d4724ac6a513cb7d03bb6cf24fcfbb40603345bdc0
Instruction Fuzzy Hash: 9601AC72300AC8C6E7048B56F4006CEA760EFBABD0F544139DE5913B99CE3CC5828741

Function 000001EF1F216760 Relevance: 3.4, APIs: 2, Instructions: 391COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 000001EF1F2167C3
ShellExecuteW.SHELL32 ref: 000001EF1F216E0A

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: ExecuteFileModuleNameShell
String ID:
API String ID: 1703432166-0
Opcode ID: fe5f936ad51912396a16051190f235964faa5b999b91d0fd8144819332c0c722
Instruction ID: cd104816e422e206192b43c3f9efed98d43f957c0757fe6f10cbafca1711884a
Opcode Fuzzy Hash: fe5f936ad51912396a16051190f235964faa5b999b91d0fd8144819332c0c722
Instruction Fuzzy Hash: 1E121B73625FC88ADB508F29E88069EB3A4F798794F505229EEDD57B58EB38C191C700

Function 000001EF1F23F7F4 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 000001EF1F23FA43
RaiseException.KERNEL32 ref: 000001EF1F23FA54

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 57a16f90b848e9bfce21c4af82cc5806e79d9fd20c8b8e6b755f3e4c735a4a33
Instruction ID: e8beafdcf45cd855fefde0549dc4a4c5ce7030194083ed4d17b70038dbd87c10
Opcode Fuzzy Hash: 57a16f90b848e9bfce21c4af82cc5806e79d9fd20c8b8e6b755f3e4c735a4a33
Instruction Fuzzy Hash: 23B13CB3600BC8CBE719CF29D44579C7BA0F758B48F158966DEA9877A8CB39C492C701

Function 000001EF1F1D5EE0 Relevance: 3.1, APIs: 2, Instructions: 145encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 000001EF1F1D5F6D
LocalFree.KERNEL32 ref: 000001EF1F1D5FFF

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 954457113285778d50c821c121948cd4730c0b879fdcd44a177dc9180500489d
Instruction ID: 1ea4d4d86480b6227f3cd1818fb514bf70d94b131538c1971e0e590b82daf45f
Opcode Fuzzy Hash: 954457113285778d50c821c121948cd4730c0b879fdcd44a177dc9180500489d
Instruction Fuzzy Hash: B0617A73B10BC4DAEB10CF74E4543DD33B1EB6978CF008229EE9956A89DB78C5969340

Function 000001EF1F2121C0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptProtectData.CRYPT32 ref: 000001EF1F212218
LocalFree.KERNEL32 ref: 000001EF1F2122AA

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalProtect
String ID:
API String ID: 2714945720-0
Opcode ID: 6da8b2380d1e6afdbe15ad09ed0a82a6e20629f9e1f2d0947d1afcdde56a6e99
Instruction ID: dc283d74b7e14fc1416ef49d355a8e1b299a9656de8ac8f99af511dc6d80d535
Opcode Fuzzy Hash: 6da8b2380d1e6afdbe15ad09ed0a82a6e20629f9e1f2d0947d1afcdde56a6e99
Instruction Fuzzy Hash: F7414633618BC4CAE3208F74E4503DD37A4FB6978CF444229EE8856E8ADB79C5A5C744

Function 000001EF1F2128C0 Relevance: 3.0, Strings: 2, Instructions: 529COMMON

Download Yara Rule

Strings

%, xrefs: 000001EF1F212F24
+, xrefs: 000001EF1F212F3F

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID: %$+
API String ID: 0-2626897407
Opcode ID: 6ebca456c64798718904c68f0384751ff12128c15bec015e12c461bf84b58bbb
Instruction ID: c572095b40f17471fa9f678ca00b1b3b2da32e358520fc69e4b2b2ef7dde1819
Opcode Fuzzy Hash: 6ebca456c64798718904c68f0384751ff12128c15bec015e12c461bf84b58bbb
Instruction Fuzzy Hash: 6A224A73B18AC8CAFB21CB64D4503ED6361EF66788F444239EE6957BC9DA38C486C345

Function 000001EF1F2429F4 Relevance: 2.9, Strings: 2, Instructions: 358COMMONLIBRARYCODE

Download Yara Rule

Strings

am/pm, xrefs: 000001EF1F242CA3
a/p, xrefs: 000001EF1F242D0E

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID: a/p$am/pm
API String ID: 0-3206640213
Opcode ID: dad867be523f7f4d56baa7635c1cdc645b8584f083e4b69fc353e0e6fb1d2414
Instruction ID: f07969c3b731922137cf27a610484ffb07f6e48f46d33cb731610582a60253b3
Opcode Fuzzy Hash: dad867be523f7f4d56baa7635c1cdc645b8584f083e4b69fc353e0e6fb1d2414
Instruction Fuzzy Hash: 29E19A336006C8C5E768CF66C5547ED22A0FF76784F55412EEE2A47AD8DBB8C9C29302

Function 000001EF1F1CFEE0 Relevance: 2.7, Strings: 2, Instructions: 226COMMON

Download Yara Rule

Strings

dumps, xrefs: 000001EF1F1CFF28
emoji, xrefs: 000001EF1F1CFF50

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID: dumps$emoji
API String ID: 0-2873254224
Opcode ID: f8535acecb17c690f06c0e0ba6f1687d176f0130c3836bd27bf140364c5ef847
Instruction ID: bbb0061d81415bc7cd455152a6de3425859b821505bd2e557a1935fbae6287fd
Opcode Fuzzy Hash: f8535acecb17c690f06c0e0ba6f1687d176f0130c3836bd27bf140364c5ef847
Instruction Fuzzy Hash: F7B12C33929BC886D761CB25E88029EB7B4F799784F545315FECD22B59EB38C291CB00

Function 000001EF1F244D78 Relevance: 1.9, APIs: 1, Instructions: 373COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 000001EF1F244EC0

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 887f096ba579c82ce3addeca72037ef6bfed22f3c0b28203f2db4495cb1e4078
Instruction ID: 067a0dbe00df39124291cb4635a0e06ccc33c9cca86fb9e60db20c16f9a58b7f
Opcode Fuzzy Hash: 887f096ba579c82ce3addeca72037ef6bfed22f3c0b28203f2db4495cb1e4078
Instruction Fuzzy Hash: 0512AD73A08BC8C6E751CF28D4053ED77A4FB68748F459229EFA886692EB74D1C6C301

Function 000001EF1F20CF70 Relevance: 1.7, APIs: 1, Instructions: 232COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F20D28B

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 474e3a437ea233f98959df63cb75406d1df34f3a045781f6baf1a50faa7e5945
Instruction ID: 85d924ad258e6709e6c6a868dfc0fc4f9ad5ebd6d2250e8ded241b7e84d40c19
Opcode Fuzzy Hash: 474e3a437ea233f98959df63cb75406d1df34f3a045781f6baf1a50faa7e5945
Instruction Fuzzy Hash: A7A17533606BD9C9EB008BA9D4903EC67B0E769B48F94452ADF9E53B59DB39C092C341

Function 000001EF1F20CC50 Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F20CF64

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8e26d5924d2bdda6809c7ba14e83fc4a85feecd9e9e7ccd546660065fe342c69
Instruction ID: 7cb013c8ddcddebfa0fb33f5bf060b2816671307c04189d93ce55cc2ad76286e
Opcode Fuzzy Hash: 8e26d5924d2bdda6809c7ba14e83fc4a85feecd9e9e7ccd546660065fe342c69
Instruction Fuzzy Hash: DBA15573615BD8C9EB00CBA9D4803EC67B0F769B48F54852ADF9A53B59DB39C092C341

Function 000001EF1F20C930 Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F20CC44

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: c119fda8a9de2da8aa704513d54b9ca19ba9b462ee068ab1662025d9693643fb
Instruction ID: eb2ed130b12ce67c5f0d8c37aec928c97bbe9dea1bd3aabdd96d625f0d93bb17
Opcode Fuzzy Hash: c119fda8a9de2da8aa704513d54b9ca19ba9b462ee068ab1662025d9693643fb
Instruction Fuzzy Hash: 8BA14473605BD8C9EB00CBAAD4903EC67B0F769B48F54842ADF9A57B59DB39C092C350

Function 000001EF1F20C300 Relevance: 1.7, APIs: 1, Instructions: 214COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F20C5F8

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: ab935af1eedc93a965aa02f57c9afe097d336cb0155c139ee9fc26cc7237c962
Instruction ID: d240806a758deaf54b90d435987c2a1d7587fa7041c37510b20632d3be454e09
Opcode Fuzzy Hash: ab935af1eedc93a965aa02f57c9afe097d336cb0155c139ee9fc26cc7237c962
Instruction Fuzzy Hash: 6FA16773615BD8CAEB108B69D4803EC67B0F769B48F54442ACF9E67B55DB39C092C350

Function 000001EF1F20D2A0 Relevance: 1.7, APIs: 1, Instructions: 210COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F20D598

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: adea9a2f053ff77c94f107ab8ec5be1b99452ae781f7e1d9d0e1f39d926e6c83
Instruction ID: fd8aff5c850a25662010a1f8e4aff3ff5803cbb0d9968744649aa5570356c2eb
Opcode Fuzzy Hash: adea9a2f053ff77c94f107ab8ec5be1b99452ae781f7e1d9d0e1f39d926e6c83
Instruction Fuzzy Hash: B1A15533602BD8CAEB108BA9D4903EC67B0E769B48F94442ACF9E57B55DB39D092C340

Function 000001EF1F247620 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 000001EF1F2381FC: GetLastError.KERNEL32 ref: 000001EF1F23820B
Part of subcall function 000001EF1F2381FC: FlsGetValue.KERNEL32 ref: 000001EF1F238220
Part of subcall function 000001EF1F2381FC: SetLastError.KERNEL32 ref: 000001EF1F2382AB

Part of subcall function 000001EF1F2381FC: FlsSetValue.KERNEL32 ref: 000001EF1F238241

GetLocaleInfoW.KERNEL32 ref: 000001EF1F247688

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: 1d8e405bb44b78bdea7029598407ccfb6a808eb35fd889ed9364ebfb982fc4a2
Instruction ID: 965c759ce4fc7b1e5027ad0c01d7574b11a975762663ce48dbbac4f8b7f3afa4
Opcode Fuzzy Hash: 1d8e405bb44b78bdea7029598407ccfb6a808eb35fd889ed9364ebfb982fc4a2
Instruction Fuzzy Hash: 973181332007C9C6EB24CB25E4513DE73A2FBB9784F40813D9EBA87295DB78D5928701

Function 000001EF1F247270 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001EF1F2381FC: GetLastError.KERNEL32 ref: 000001EF1F23820B
Part of subcall function 000001EF1F2381FC: FlsGetValue.KERNEL32 ref: 000001EF1F238220
Part of subcall function 000001EF1F2381FC: SetLastError.KERNEL32 ref: 000001EF1F2382AB

EnumSystemLocalesW.KERNEL32 ref: 000001EF1F24730E

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 58800bb6c4d0d9c609f2f6f306793987a7a581936cd52f064e9451565f60872b
Instruction ID: 4f5d7ea75cdc92ffb7af99d7f85dcda3f3c0583a8afc78e8c8514469c5b670cb
Opcode Fuzzy Hash: 58800bb6c4d0d9c609f2f6f306793987a7a581936cd52f064e9451565f60872b
Instruction Fuzzy Hash: BA118E73A146C8CAEB15DF66D0407DC7BA1FBA0BA0F444129EE76472D4CAA8C5D2C741

Function 000001EF1F1F9A10 Relevance: 1.6, Strings: 1, Instructions: 304COMMON

Download Yara Rule

Strings

., xrefs: 000001EF1F1F9D10

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 3daecdbd55c9c22db29b6e9ecc3dd405d8fe90d94cda49bc0af5f93eb4a6cfc3
Instruction ID: 3f2a92f6375f5c73e2425298a44e5d47e2ac4f8a8aed03fdff8cdec62bb015ed
Opcode Fuzzy Hash: 3daecdbd55c9c22db29b6e9ecc3dd405d8fe90d94cda49bc0af5f93eb4a6cfc3
Instruction Fuzzy Hash: 07C18333600BC8C6EB64EF29D8443ED63A2FB657A4F94422ADE5A53794DB74C8C6C740

Function 000001EF1F247828 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 000001EF1F2381FC: GetLastError.KERNEL32 ref: 000001EF1F23820B
Part of subcall function 000001EF1F2381FC: FlsGetValue.KERNEL32 ref: 000001EF1F238220
Part of subcall function 000001EF1F2381FC: SetLastError.KERNEL32 ref: 000001EF1F2382AB

GetLocaleInfoW.KERNEL32 ref: 000001EF1F24785F

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: a206680715a2a1e8ed04527063a7d486e32d99efc1662854cd7c3fa16e13c692
Instruction ID: e976c715603b325d58180dbadebbb3bd32bd3963ab8364833f3acf6c2afbbc38
Opcode Fuzzy Hash: a206680715a2a1e8ed04527063a7d486e32d99efc1662854cd7c3fa16e13c692
Instruction Fuzzy Hash: BE1123337106D8C7E7788726E040B9E2AA0EBB4764F144639DE7A476C4E766C8C3D701

Function 000001EF1F247340 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001EF1F2381FC: GetLastError.KERNEL32 ref: 000001EF1F23820B
Part of subcall function 000001EF1F2381FC: FlsGetValue.KERNEL32 ref: 000001EF1F238220
Part of subcall function 000001EF1F2381FC: SetLastError.KERNEL32 ref: 000001EF1F2382AB

EnumSystemLocalesW.KERNEL32 ref: 000001EF1F2473BE

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: fd6ab9fb082eedb8b2c8f5dae22463227a7604b7e6560a2cecb061507bc0ecca
Instruction ID: 24be08ce8a47f913dac4b65b39ae8a48a10d8054e709c4872eae195330d8c690
Opcode Fuzzy Hash: fd6ab9fb082eedb8b2c8f5dae22463227a7604b7e6560a2cecb061507bc0ecca
Instruction Fuzzy Hash: E201B1736042C8C6EB105F15E440BDD7AE2EB70BA4F458239DE71472C4CBB884C28702

Function 000001EF1F20F1B5 Relevance: 1.5, APIs: 1, Instructions: 34comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 000001EF1F20F1FD
CoSetProxyBlanket.OLE32 ref: 000001EF1F20F252

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: BlanketCreateInstanceProxy
String ID:
API String ID: 1899829610-0
Opcode ID: a787f5c70b0da52dd39980db2e05650dfd34504bfd18cc3456a54f99b4034af6
Instruction ID: 503f52dfdda9e4352049bd01973f20edd97dff226d5ceb0ac3318a5541b98213
Opcode Fuzzy Hash: a787f5c70b0da52dd39980db2e05650dfd34504bfd18cc3456a54f99b4034af6
Instruction Fuzzy Hash: 92014B33701AD8CAFB22DBA5E4013ED67A1ABA9758F40012A8E5A53A54EB39C1878345

Function 000001EF1F23BC68 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32 ref: 000001EF1F23BCB7

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: f8325550294e071d185dd7c07cc84b153cedbfbab89d167ada8b5b9da10e3d51
Instruction ID: 03f880702e9fa53477d7fe69af20fee77ad87d7ee0d47e46d9064348704a5142
Opcode Fuzzy Hash: f8325550294e071d185dd7c07cc84b153cedbfbab89d167ada8b5b9da10e3d51
Instruction Fuzzy Hash: 40F03CB7300AC8C3E704DB15F8916DD2365FBA9B80F549039EE6983365CE3CC9928B45

Function 000001EF1F247F00 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001EF1F247F04

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 2bd217787b85c097b3ccba094d4d30ef76119dd789487d52041f712bc5b72eb7
Instruction ID: 783645c4bd8abd1e6e6874e24215f7f636b937673204c6cc274dc7b37229536e
Opcode Fuzzy Hash: 2bd217787b85c097b3ccba094d4d30ef76119dd789487d52041f712bc5b72eb7
Instruction Fuzzy Hash: 4BB09235E03AC9C6EA082B12EC8A34823A4BF69B10F88412CCC1C41320DB2C08E66B22

Function 000001EF1F1C83D0 Relevance: .8, Instructions: 795COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47f8a865815a333fb31a3139213f52897c50bd5da47d4749d87050c12ea7adb8
Instruction ID: 6b64e41833ab57b5c0a2af491202727e2ec5fda4a899e00908ae829e294be632
Opcode Fuzzy Hash: 47f8a865815a333fb31a3139213f52897c50bd5da47d4749d87050c12ea7adb8
Instruction Fuzzy Hash: 2BA2A336615FD88AD7408FAAEC8119D73BAF7587A8B101629EFCC57F19EBB4C1548700

Function 000001EF1F1F66A0 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff8ff783da37649173626c7f7158936b22345755ff077d27462f74136c1878ba
Instruction ID: 17126736b6a9572c6b285ccd700ec933fbabd9e5d716c324ae151a4fbb5d18cb
Opcode Fuzzy Hash: ff8ff783da37649173626c7f7158936b22345755ff077d27462f74136c1878ba
Instruction Fuzzy Hash: 4EC104B37246E887E71ACF66D9546ADB762F7E4BE0F45C124DE4613B88D638C846C700

Function 000001EF1F1A6610 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1c655470eb6c7bb81691da43902db7f2885c5918c2f618bc683406a0d28f36b
Instruction ID: ef1f147810291bf8ef768d4a9b3fe5d4bad9e688569c287570664e115ea184d2
Opcode Fuzzy Hash: e1c655470eb6c7bb81691da43902db7f2885c5918c2f618bc683406a0d28f36b
Instruction Fuzzy Hash: 9C12C632515FC88AD7618F29E84139AB3A4F799748F505329EECC67B19EB38C295CB04

Function 000001EF1F20FDB0 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34fb1097c6f2363caac24c1e5b45ae24c1a6ca50cb597d280e611698873f3a91
Instruction ID: 10ae0e196f0d6c2e56d174c7384386da8483dcc8a8201edbe12a4240d9036712
Opcode Fuzzy Hash: 34fb1097c6f2363caac24c1e5b45ae24c1a6ca50cb597d280e611698873f3a91
Instruction Fuzzy Hash: 42C1C3B3A146948BE355CF2DD40195D7BA0F398B84F40A629EF56C3B01E778E9A5CF80

Function 000001EF1F238C34 Relevance: .3, Instructions: 309COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: f39b52ed8424437b231758bdb93ffc4f840ea96165d05f634ae1d9fa5926c97e
Instruction ID: a101ba8f241b461974841b013ba09a5c452cda59e3d6d6311d1cd5dbccd6cb3e
Opcode Fuzzy Hash: f39b52ed8424437b231758bdb93ffc4f840ea96165d05f634ae1d9fa5926c97e
Instruction Fuzzy Hash: ADC1E8B73046C8C6EB60DB61D4103EE77A1FBB9B88F504179DE6A4B694DB74C586C302

Function 000001EF1F23088C Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58993cc49f4dd608ba7a820bbbd73e261f21bf312b089c0bcad54f873d9ee38f
Instruction ID: e108e935e92fbeb6a0bae19f411d44c26e390ce05abc4b50dee15ce747f7cf29
Opcode Fuzzy Hash: 58993cc49f4dd608ba7a820bbbd73e261f21bf312b089c0bcad54f873d9ee38f
Instruction Fuzzy Hash: F091E2B33142CCC7EA28CB25E0607EE1690AF69B9CF14057D9E7E4B7C5D92CC4879622

Function 000001EF1F2358D0 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29683b013f8ac11bc27aba6a7a5ac6f6d500d56baa688bda10aee56a2ac3d60c
Instruction ID: 2e019d67c13683b0fa24b298048284fc134a1fdaeefc68e07cf91e48ebfdd506
Opcode Fuzzy Hash: 29683b013f8ac11bc27aba6a7a5ac6f6d500d56baa688bda10aee56a2ac3d60c
Instruction Fuzzy Hash: 0CC1D0B32006CAC7EB28CF25C4517AD37A0EFA9B48F144269CE690B795DB35C883D742

Function 000001EF1F246984 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: ErrorLast$Value_invalid_parameter_noinfo
String ID:
API String ID: 1500699246-0
Opcode ID: 8359977cf5bdbaae4c5aab83856ae08c3cfc9e43f61b49509031a229a49b9122
Instruction ID: 306ad2e61c06d071098cb0e4909b5aec0b3e6742ee6dfd0904cfea5caa94bdbd
Opcode Fuzzy Hash: 8359977cf5bdbaae4c5aab83856ae08c3cfc9e43f61b49509031a229a49b9122
Instruction Fuzzy Hash: 3BB1AEB3210ADCC6EB64DF21D4217DD77A1EB74B88F408139DE6587A89DBB8C5828742

Function 000001EF1F235044 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 961d3e7eb4dbe1c42d41fae25b585760f3c2351026af9e0dc6bb8535c2ebc898
Instruction ID: 582b4f21cf340fbc393e2d88ab436328452ad22a13d229465b71de9b606326d9
Opcode Fuzzy Hash: 961d3e7eb4dbe1c42d41fae25b585760f3c2351026af9e0dc6bb8535c2ebc898
Instruction Fuzzy Hash: 12B171B31147C9C6E7648F29C4513AC3BB0EBADB48F240169CE9E47399DB75C582C742

Function 000001EF1F237060 Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 091f4ed8b1e5dd1d34995432db1c011eef8551be6e7d0024f18eedab46e94d23
Instruction ID: afe4c8590c37985538a86f253f8d020271269d699e86e59eb49b93124bd2bfcc
Opcode Fuzzy Hash: 091f4ed8b1e5dd1d34995432db1c011eef8551be6e7d0024f18eedab46e94d23
Instruction Fuzzy Hash: C88182B3610AD8C6EF64CF65D4913AD2360FB58B98F14466AEE6E97B95CF34C082C301

Function 000001EF1F1A6D20 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 881b6d5b2af3ae56bb85f0ec379a2b79ee645c04a68fd9e631602ee47c2f7095
Instruction ID: 211abfefc6bfdacc5ef9b49d38e87915931dc4d801ab3632765bd6a9b63cea5e
Opcode Fuzzy Hash: 881b6d5b2af3ae56bb85f0ec379a2b79ee645c04a68fd9e631602ee47c2f7095
Instruction Fuzzy Hash: 84B1F332A15FC88AD7118FA9E84029DB3B5F7997A8F145225EE8C63F19EBB4C195C700

Function 000001EF1F25E2CC Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0101b5bfc7e861b0726451e18251d4484926b191a0e7c85200f779e0e00e1385
Instruction ID: 340b07307da32572ddaf3a65f19506074b1d9f648ebdac3b430d579285647a9e
Opcode Fuzzy Hash: 0101b5bfc7e861b0726451e18251d4484926b191a0e7c85200f779e0e00e1385
Instruction Fuzzy Hash: 8A61C133714AD8C7F7688F28C4543FD6681AF64770F18863DEE75876E5E669C8828A02

Function 000001EF1F2101F0 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8564914535ee6488183395aa034df85c3b96b43cc627a35cfc23d0d483c1855f
Instruction ID: 65eb4c72257156b6bee6a07060891ad35d1df3d064797327c03943e7215abce1
Opcode Fuzzy Hash: 8564914535ee6488183395aa034df85c3b96b43cc627a35cfc23d0d483c1855f
Instruction Fuzzy Hash: 7D61DD2321E2C48BD30EDF7C589106D7F61D3B7908388469DEA85EBB4BC504C95ACBA6

Function 000001EF1F23EE06 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8361dc49c257ca5c58a7e22c82553e287cd3153b8e2e7dc21ca7117d7e5b9edd
Instruction ID: bb59d82646e6bb4efe90be664b9a029fc7319960434a495955365a794fd8d694
Opcode Fuzzy Hash: 8361dc49c257ca5c58a7e22c82553e287cd3153b8e2e7dc21ca7117d7e5b9edd
Instruction Fuzzy Hash: C451E6B3208BC4C7DB74CB19D4403AD6691FB697D4F504239DEA943B99D77DC48A8B02

Function 000001EF1F218230 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08e682c8f50e6a31ebca66eccf7bc014078cfb37ed238d168109819e35b8cd79
Instruction ID: 38b78d58d521853dddc1bf4e2614913fe8cd270128da360d5879900a8343f44d
Opcode Fuzzy Hash: 08e682c8f50e6a31ebca66eccf7bc014078cfb37ed238d168109819e35b8cd79
Instruction Fuzzy Hash: AC51E5A3B056C443DB248B49F842796F7A5FB987C5F00A12AEE8D57B58EB3CD5818700

Function 000001EF1F234A00 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction ID: 637f7b93704c94973db58b95e3e8dc45dd579f120d05380ea4f375e5cb57f603
Opcode Fuzzy Hash: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction Fuzzy Hash: FE51A2BB6106D8C7E7248B29C06079D37A1EBA9F58F3441E9CE581B7A4D736C883C742

Function 000001EF1F2347FC Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction ID: 81dc6ef6fc736f455628be589684c2e8ed082aff61ddbed79611f89e5acabcb1
Opcode Fuzzy Hash: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction Fuzzy Hash: 6E5191BB610AD8C7E7248F29C4507AC37A1EB69F58F2441A9CE99077A8C736CC93C741

Function 000001EF1F249EA0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 7d3dc9fee99d1a793cda94341ed908f3bcfa2b26da772502c09f4d0e1d5ddaa1
Instruction ID: 17757e87b505acaacb84753d81f67889f8fb885962547451ca63a3e212f111ff
Opcode Fuzzy Hash: 7d3dc9fee99d1a793cda94341ed908f3bcfa2b26da772502c09f4d0e1d5ddaa1
Instruction Fuzzy Hash: DA418173311AD882EF04CF6AD92469D6391B768FD0F49903ADE1987B58DA7DC5838300

Function 000001EF1F272158 Relevance: .1, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2295f239adf1388c64878ca58765f9266ebdeed47219a3e9e064689d8b0f3c14
Instruction ID: 2c65cf3bc0a46090b8eeaa0f20db610698f1f9bf91ed558e0d11c3441db336b7
Opcode Fuzzy Hash: 2295f239adf1388c64878ca58765f9266ebdeed47219a3e9e064689d8b0f3c14
Instruction Fuzzy Hash: A431E4AB54DAC88AF3534B78CC6528D3F90BBB3F04B4D816EDF90861C7E55518868B53

Function 000001EF1F272160 Relevance: .1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5475de88c30e4da7700ce0d73f9b88d01c18df29cf835ab149d96aba6dc9f3d
Instruction ID: b734056802d91c18dc538860dbdc10da6e2185a1d6858c0ad57597229fdf8043
Opcode Fuzzy Hash: e5475de88c30e4da7700ce0d73f9b88d01c18df29cf835ab149d96aba6dc9f3d
Instruction Fuzzy Hash: 4431D4AB54DAC88AF3534B78CC6528D3E90BBB3F04B4D816EDF90861C7E55608868B53

Function 000001EF1F272138 Relevance: .1, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba256123bc96f6e3f742fa23820658b676d3a0366c9ddb9c92781a93f555a0f9
Instruction ID: 748c3fa613348fa7af2fc9dd7a807cbdbb8ebaa63e6404d823a693969df0d374
Opcode Fuzzy Hash: ba256123bc96f6e3f742fa23820658b676d3a0366c9ddb9c92781a93f555a0f9
Instruction Fuzzy Hash: 2A31C1AB54DAC886F3928B78CD6539D2F90BBB3F04F0D91AEDF90861D7A54508424B43

Function 000001EF1F272398 Relevance: .1, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db6ef5ff4efb3e8432d6a1c264e429b5929ea475b2ea2b4a4b5f05bd04cf37f5
Instruction ID: 2f256c58e6821a219e64e33306b9050a82b32f0e757f296ea32b561bd8a4d249
Opcode Fuzzy Hash: db6ef5ff4efb3e8432d6a1c264e429b5929ea475b2ea2b4a4b5f05bd04cf37f5
Instruction Fuzzy Hash: 502147B750DAC84BE3530F78CD6629D3F91ABB3B00F4E82BDDF90021C7A55918874A12

Function 000001EF1F2722D8 Relevance: .1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 621a476faf91e54c4cc03539473d8505f5c368e1576c38102583692f8d871d13
Instruction ID: cd1b819b214100c9e1a61aaa431b24f50ff02d7a9444202f79674c60420eaa36
Opcode Fuzzy Hash: 621a476faf91e54c4cc03539473d8505f5c368e1576c38102583692f8d871d13
Instruction Fuzzy Hash: 21111BF740EAC84BF3924B78CD6629D3F909BB3F05F4D81AEDF90421C7A51958465A03

Function 000001EF1F24C220 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2013e6b94b2d003a30e75ea77be44ea9f3ccf8fece6d65ea3e8959b5fc900595
Instruction ID: 4720cf45a9dd3b5f9c65ff322af4acd8e62f2fabbd012852e9838febbd58552b
Opcode Fuzzy Hash: 2013e6b94b2d003a30e75ea77be44ea9f3ccf8fece6d65ea3e8959b5fc900595
Instruction Fuzzy Hash: 3DF04F726146D88BDBE48F2CE84265977D0E728380F90802DDA9987B04D63C84A28F95

Function 000001EF1F20ED30 Relevance: 28.7, APIs: 19, Instructions: 177processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000001EF1F20ED86
Process32FirstW.KERNEL32 ref: 000001EF1F20EDCA
Process32NextW.KERNEL32 ref: 000001EF1F20EDDF
OpenProcess.KERNEL32 ref: 000001EF1F20EE1B
OpenProcessToken.ADVAPI32 ref: 000001EF1F20EE42
GetTokenInformation.ADVAPI32 ref: 000001EF1F20EE6E
GetLastError.KERNEL32 ref: 000001EF1F20EE7C
GetTokenInformation.ADVAPI32 ref: 000001EF1F20EEBC
ConvertSidToStringSidA.ADVAPI32 ref: 000001EF1F20EED3
CloseHandle.KERNEL32 ref: 000001EF1F20EF46
CloseHandle.KERNEL32 ref: 000001EF1F20EF51
CloseHandle.KERNEL32 ref: 000001EF1F20EFB6
Process32NextW.KERNEL32 ref: 000001EF1F20EFC3
CloseHandle.KERNEL32 ref: 000001EF1F20EFE9
CloseHandle.KERNEL32 ref: 000001EF1F20EFF2
CloseHandle.KERNEL32 ref: 000001EF1F20F007

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: CloseHandle$Process32Token$InformationNextOpenProcess$ConvertCreateErrorFirstLastSnapshotStringToolhelp32
String ID:
API String ID: 3925315391-0
Opcode ID: 9cfa9a338c49679a1929b549c81fccef5f16dbb46e3a6c3e399b60bd0c466e0c
Instruction ID: 1969116887bce41cb484bad10fe57b8a751ab56364f9f5c85136579172e3b4b8
Opcode Fuzzy Hash: 9cfa9a338c49679a1929b549c81fccef5f16dbb46e3a6c3e399b60bd0c466e0c
Instruction Fuzzy Hash: D9816033215BC8C2EB108B11E84479EB3A5FBA9B94F404129EE6947B99DF79C5C6CB01

Function 000001EF1F22FDCC Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 407COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F22FDFB
_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F22FECB

Strings

0, xrefs: 000001EF1F22FE9D
0, xrefs: 000001EF1F22FF07
0, xrefs: 000001EF1F22FEF5

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$0$0
API String ID: 3215553584-3137946472
Opcode ID: c13ea352d321776aceeea9581779599aef3778c14aa0c6b54d648fb53a65a266
Instruction ID: b00946d5df5109f1951eb976265dcf05d9ca9d5007560540cdbb497989dfcda7
Opcode Fuzzy Hash: c13ea352d321776aceeea9581779599aef3778c14aa0c6b54d648fb53a65a266
Instruction Fuzzy Hash: EFE1D6732056CDCAF761CF28C0907ED2B95DB76B88F54406ECEA8477D6C62989DB8312

Function 000001EF1F214C60 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 159COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000001EF1F214CDD
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000001EF1F214D25
Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F214EA1
Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F214EB4
Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F214EBA

Strings

false, xrefs: 000001EF1F214DAD
true, xrefs: 000001EF1F214DDC
bad locale name, xrefs: 000001EF1F214EA7

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: ac14ec4081e7218eb524f80c83b8b839b3b5ebd962557539344c6cba77ef8f3b
Instruction ID: 8cb0e1fba9dbf5853b42958f7bdc104d54dbedfa5ca06b9067e3d78c43aa49b8
Opcode Fuzzy Hash: ac14ec4081e7218eb524f80c83b8b839b3b5ebd962557539344c6cba77ef8f3b
Instruction Fuzzy Hash: 5D714833B02BC4CAEB159FA0D4503EC33A5EFA5708F54413D9E6867A99DB348592D34A

Function 000001EF1F23BCE4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000001EF1F23BE60
GetProcAddress.KERNEL32 ref: 000001EF1F23BE6C

Strings

ext-ms-, xrefs: 000001EF1F23BDBD
api-ms-, xrefs: 000001EF1F23BDAA

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: c6120ce6c378417c8061f2daa80316ce8b84504fe2d3d9dfde353b277e126bba
Instruction ID: e65cb3f3e029cffea6b6aa6eea16048b7e4ebc7757930821361e0bed616ef298
Opcode Fuzzy Hash: c6120ce6c378417c8061f2daa80316ce8b84504fe2d3d9dfde353b277e126bba
Instruction Fuzzy Hash: 8741BF73321AD8C2EA15DF16D8447DD2391BF6ABA0F89423DDE2947784DE38C4878301

Function 000001EF1F215090 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 000001EF1F2150FB
InternetOpenUrlA.WININET ref: 000001EF1F215130
InternetReadFile.WININET ref: 000001EF1F215151
InternetReadFile.WININET ref: 000001EF1F21518F
InternetCloseHandle.WININET ref: 000001EF1F21519C
InternetCloseHandle.WININET ref: 000001EF1F2151A5

Strings

File Downloader, xrefs: 000001EF1F2150F4

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandleOpenRead
String ID: File Downloader
API String ID: 4038090926-3631955488
Opcode ID: d760029ad861ea7f7ea2ffc299629ee0db5f3c755485599aed123bc73a668a15
Instruction ID: 1dd220e21875286b4896a1d839e1c68edb67ef10a82e986205fa83ba89ad9849
Opcode Fuzzy Hash: d760029ad861ea7f7ea2ffc299629ee0db5f3c755485599aed123bc73a668a15
Instruction Fuzzy Hash: 95318332614BC8C2E7208F15E8507DEB360FBA9BC4F444129EE5943B58DF78C582CB01

Function 000001EF1F2332AC Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F2332EF
_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F2336DC
_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F233978

Strings

f, xrefs: 000001EF1F233411
p, xrefs: 000001EF1F233419
p, xrefs: 000001EF1F2333A1

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: da133f4d1d1d50a9f8077a7ed93c78c5851a9c9ee1111e96f3e2a2a160aeb47c
Instruction ID: 01e9334ea9fb750e17cc6cb1f11bdd03c803d59d5529837087b5ebbb93359680
Opcode Fuzzy Hash: da133f4d1d1d50a9f8077a7ed93c78c5851a9c9ee1111e96f3e2a2a160aeb47c
Instruction Fuzzy Hash: A612B1B36042C9C7FB209B15D0547EEB691FBA8754F84416EEEA2467C4D739CEC28B06

Function 000001EF1F2381FC Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001EF1F23820B
FlsGetValue.KERNEL32 ref: 000001EF1F238220
FlsSetValue.KERNEL32 ref: 000001EF1F238241
FlsSetValue.KERNEL32 ref: 000001EF1F23826E
FlsSetValue.KERNEL32 ref: 000001EF1F23827F
FlsSetValue.KERNEL32 ref: 000001EF1F238290
SetLastError.KERNEL32 ref: 000001EF1F2382AB

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 9dbd973f53b5f3675d4cbee4168395d536b95caf7b78cb8abb3a36471aa361d6
Instruction ID: 3277b1f0e2ff66738939d56fce4dd6cfa335371f70d5ade086faa44bed4876dc
Opcode Fuzzy Hash: 9dbd973f53b5f3675d4cbee4168395d536b95caf7b78cb8abb3a36471aa361d6
Instruction Fuzzy Hash: 23217FB3304AC8C3FA54A772D6653ED52925FADBA0F1447BC9D364B6D6DE6884834202

Function 000001EF1F24ABDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001EF1F24AC0D
GetLastError.KERNEL32 ref: 000001EF1F24AC19
CloseHandle.KERNEL32 ref: 000001EF1F24AC31
CreateFileW.KERNEL32 ref: 000001EF1F24AC5C
WriteConsoleW.KERNEL32 ref: 000001EF1F24AC7B

Strings

CONOUT$, xrefs: 000001EF1F24AC3D

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 97ef1f90b5d1e549fd4d93c948d975b58c02b300c1de8e440893a5efab19f807
Instruction ID: ae8f02ff6ba2bf07be6ce7713684113c7c20f5f00734d0e503b06fd78651c947
Opcode Fuzzy Hash: 97ef1f90b5d1e549fd4d93c948d975b58c02b300c1de8e440893a5efab19f807
Instruction Fuzzy Hash: 35116032314AC4C6E7508B56E86439D73A0FBBABE4F444338EE6987794DF78C4868B45

Function 000001EF1F25B73C Relevance: 9.2, APIs: 6, Instructions: 239COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 000001EF1F25B7E9
MultiByteToWideChar.KERNEL32 ref: 000001EF1F25B885
MultiByteToWideChar.KERNEL32 ref: 000001EF1F25B92E
MultiByteToWideChar.KERNEL32 ref: 000001EF1F25B958
MultiByteToWideChar.KERNEL32 ref: 000001EF1F25BA00
CompareStringEx.KERNEL32 ref: 000001EF1F25BA4D

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: ab7e75f2883cad40e90fab743296f144bd79ee85a7c99ab5de0f741cdd8f7a66
Instruction ID: 855381286e2aa1d6d57c0005422007ee8d8f5565a296b6f5b33f2aee927b5ff9
Opcode Fuzzy Hash: ab7e75f2883cad40e90fab743296f144bd79ee85a7c99ab5de0f741cdd8f7a66
Instruction Fuzzy Hash: 08A1A0736006C8C6FB218F61D4143ED6691EF61BA4F584639DE780BBE5DB38C8868F42

Function 000001EF1F25B3DC Relevance: 9.2, APIs: 6, Instructions: 206COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 000001EF1F25B44C
MultiByteToWideChar.KERNEL32 ref: 000001EF1F25B4EA
LCMapStringEx.KERNEL32 ref: 000001EF1F25B553
LCMapStringEx.KERNEL32 ref: 000001EF1F25B5A5
LCMapStringEx.KERNEL32 ref: 000001EF1F25B64A
WideCharToMultiByte.KERNEL32 ref: 000001EF1F25B6A4

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: a17d41df7d4fcd83c170866fb1b58b26a6ae7521d63a390143938d7d4d5e554f
Instruction ID: 3dc2045bc0d787292406ff8c763447df515960285fbf92b4332cd22f016edced
Opcode Fuzzy Hash: a17d41df7d4fcd83c170866fb1b58b26a6ae7521d63a390143938d7d4d5e554f
Instruction Fuzzy Hash: C48150732007C4C6EB248F25D4507ED77A5FB64BA8F584629EE6947BE5DB38C4828F01

Function 000001EF1F2303B8 Relevance: 9.2, APIs: 6, Instructions: 157COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F23042A
_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F23045B
_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F23049B
_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F2304DD
_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F230512
_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F23058F

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ca3f80eaf004f362beb8f5b3b26ae04cc2cf7c865ac26bc256f85fe2d54e20e3
Instruction ID: ffab01295298357a2c1bb02b74e90bb20fbb5f4b338cb6dadc8f59bcc2841a23
Opcode Fuzzy Hash: ca3f80eaf004f362beb8f5b3b26ae04cc2cf7c865ac26bc256f85fe2d54e20e3
Instruction Fuzzy Hash: BC512DB72046CCC7E752DF24D0603ED7795AB69B48F4580A9CFA847386DA2D8987C723

Function 000001EF1F238374 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001EF1F238383
FlsSetValue.KERNEL32(?,?,-2891666E48DAA7FF,000001EF1F2340D5,?,?,?,?,000001EF1F23B584), ref: 000001EF1F2383B9
FlsSetValue.KERNEL32(?,?,-2891666E48DAA7FF,000001EF1F2340D5,?,?,?,?,000001EF1F23B584), ref: 000001EF1F2383E6
FlsSetValue.KERNEL32(?,?,-2891666E48DAA7FF,000001EF1F2340D5,?,?,?,?,000001EF1F23B584), ref: 000001EF1F2383F7
FlsSetValue.KERNEL32(?,?,-2891666E48DAA7FF,000001EF1F2340D5,?,?,?,?,000001EF1F23B584), ref: 000001EF1F238408
SetLastError.KERNEL32 ref: 000001EF1F238423

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: afe38cc287240995e2e9d2378547507dd5cbbb9e4fb21f15aad5b3e1c77e3c65
Instruction ID: cb628a18b89aa22b85f405a292570f4a40e779c335e16bdaeeaab43de781e1f3
Opcode Fuzzy Hash: afe38cc287240995e2e9d2378547507dd5cbbb9e4fb21f15aad5b3e1c77e3c65
Instruction Fuzzy Hash: 42115EB3244AC8C3F6549736D6513ED61915F68BA0F0847BC9D364B7D6DE6894C35202

Function 000001EF1F1CDB90 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 281COMMON

Download Yara Rule

APIs

__std_fs_code_page.LIBCPMT ref: 000001EF1F1CDBEF

Part of subcall function 000001EF1F259570: AreFileApisANSI.KERNEL32 ref: 000001EF1F259582

__std_exception_destroy.LIBVCRUNTIME ref: 000001EF1F1CDE97
__std_exception_destroy.LIBVCRUNTIME ref: 000001EF1F1CDF51

Strings

", ", xrefs: 000001EF1F1CDCDD
: ", xrefs: 000001EF1F1CDCAA

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy$ApisFile__std_fs_code_page
String ID: ", "$: "
API String ID: 741338541-747220369
Opcode ID: 3bcd68f9814bb557ea8ccb814301d622da0953480bf9929bb401fa145b300977
Instruction ID: 39d01399b88b81a7f7bb589a6ee23b0b391e256ccdca668342971cf3f8e4d431
Opcode Fuzzy Hash: 3bcd68f9814bb557ea8ccb814301d622da0953480bf9929bb401fa145b300977
Instruction Fuzzy Hash: D5B1AD73700A88C5EB04DF65E0643EC33A1EB65B88F504529EE6D67B9ADF74C596C380

Function 000001EF1F2432C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001EF1F2432ED
GetProcAddress.KERNEL32 ref: 000001EF1F243303
FreeLibrary.KERNEL32 ref: 000001EF1F24332A

Strings

mscoree.dll, xrefs: 000001EF1F2432E4
CorExitProcess, xrefs: 000001EF1F2432FC

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: db481cee700add6652efbd16517b6fad29b9a19914f0d4d044d41ba2919793f2
Instruction ID: 3eb0da43ff7ed4d50330478ec2e1a2788e9af35cd992068517d40ecf6fb1db97
Opcode Fuzzy Hash: db481cee700add6652efbd16517b6fad29b9a19914f0d4d044d41ba2919793f2
Instruction Fuzzy Hash: ACF04F322016C8C2EA108B25E45539D5360AFBA761F54132DCE7A496E4CF6CC5CA8741

Function 000001EF1F2382D0 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 000001EF1F2382E1
FlsSetValue.KERNEL32 ref: 000001EF1F238300
FlsSetValue.KERNEL32 ref: 000001EF1F238328
FlsSetValue.KERNEL32 ref: 000001EF1F238339
FlsSetValue.KERNEL32 ref: 000001EF1F23834A

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 57084db86b0836779ab4eb8deac276869c24b17cf807aa1c82de5e2676fed3d6
Instruction ID: ca61afe8c7951cebd1bfc284e8c30f1c08b46b09db323d662029f176fb41d03d
Opcode Fuzzy Hash: 57084db86b0836779ab4eb8deac276869c24b17cf807aa1c82de5e2676fed3d6
Instruction Fuzzy Hash: 5B114CB3240ACDC3FA68A336C4613ED11814FA8760F484BBC5C364A3C2EA6894C35203

Function 000001EF1F25D3EC Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F25D6CB

Part of subcall function 000001EF1F24A7BC: _invalid_parameter_noinfo.LIBCMT ref: 000001EF1F24A7D9

Strings

UTF-8, xrefs: 000001EF1F25D64A
UTF-16LEUNICODE, xrefs: 000001EF1F25D669
ccs, xrefs: 000001EF1F25D606

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: c93d0c80d14289c47e4e012ab7823fd63e1d2ef69c6c82be7162492af36b69b4
Instruction ID: 81d075972f1cbc62a23b408f0554473cbd809de569b1e7d37433be09db62f709
Opcode Fuzzy Hash: c93d0c80d14289c47e4e012ab7823fd63e1d2ef69c6c82be7162492af36b69b4
Instruction Fuzzy Hash: 16815EB3A082C8C6F7655F29D1603ED26A0AB31B48FD5802DDE26572B5D329D9C39F43

Function 000001EF1F1F9E10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 000001EF1F1F9FF0
__std_exception_destroy.LIBVCRUNTIME ref: 000001EF1F1F9FFD

Strings

at line , xrefs: 000001EF1F1F9E9A
, column , xrefs: 000001EF1F1F9EC8

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: at line $, column
API String ID: 2453523683-191570568
Opcode ID: aff05fec512d213ac151276bf263aa44aeb80c2bf31a07cec0c790d9dfc7e2bd
Instruction ID: e03f7e274d48ba0718b821b3e1d84c3f78a3f2465a6b45d3d5b9108c1687bb17
Opcode Fuzzy Hash: aff05fec512d213ac151276bf263aa44aeb80c2bf31a07cec0c790d9dfc7e2bd
Instruction Fuzzy Hash: BA51A073604BC4C1EA149B1AE59039E6761FBA5BE0F504229EFA917B9ADF38C4C28740

Function 000001EF1F1CC910 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000001EF1F1CC97F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000001EF1F1CC9C7
_Getctype.LIBCPMT ref: 000001EF1F1CCA05

Strings

bad locale name, xrefs: 000001EF1F1CCABE

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: std::_$GetctypeLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1612978173-1405518554
Opcode ID: 97a67ff78dc1c9865f5140c0fd7da35d8d9f7c34203690876748439388acebb1
Instruction ID: aa6feb2357853a297e5f369d3217eb51e2c21b37821b28c88c73ded5606a5d0b
Opcode Fuzzy Hash: 97a67ff78dc1c9865f5140c0fd7da35d8d9f7c34203690876748439388acebb1
Instruction Fuzzy Hash: 6B514A33702BC8DAFB10DF60E4913EC3365EF64748F544039AE9927A95EB34C5969345

Function 000001EF1F220F00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000001EF1F220F8B

Strings

?, xrefs: 000001EF1F220F40

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Open
String ID: ?
API String ID: 71445658-1684325040
Opcode ID: 830ab9ef9595898802f36f006ffe69e243d526fd7242f560466c698f4fdd17de
Instruction ID: e3ad19519577db14b58d4eeefb6a368065d2553fb9a471e8b8d6b652bc2c92d2
Opcode Fuzzy Hash: 830ab9ef9595898802f36f006ffe69e243d526fd7242f560466c698f4fdd17de
Instruction Fuzzy Hash: 2E41C473618BC481EB50CB25F48039EB3A0FBA5794F505229FEA942A99DF7CD1C5CB40

Function 000001EF1F23A888 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001EF1F23A907
WriteFile.KERNEL32 ref: 000001EF1F23ABCF
WriteFile.KERNEL32 ref: 000001EF1F23AC15
GetLastError.KERNEL32 ref: 000001EF1F23ACCB

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 523722e26ffa46449d979bd975143a43a29be3ae997596a7a20ff96f8c1017ee
Instruction ID: 1da18c2fe2323ce59cc8b987f0a5d29c60ded28504b63a71f117bd8ceac8f5bd
Opcode Fuzzy Hash: 523722e26ffa46449d979bd975143a43a29be3ae997596a7a20ff96f8c1017ee
Instruction Fuzzy Hash: CED1CE77B15AC8CAE711CFA9D4402DC37B1FB68B98F04426ACE6997B99DA34C487C701

Function 000001EF1F23B248 Relevance: 6.2, APIs: 4, Instructions: 218COMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001EF1F23B364
GetLastError.KERNEL32 ref: 000001EF1F23B3EF

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 051a95757f3cd31bcbf302130b81a7499006cb3b8c40f8426fd2f443c90a72fc
Instruction ID: 724f929c9afce276e0dd688334574af0b0da84af09d0f8bdce7f05389e00a15b
Opcode Fuzzy Hash: 051a95757f3cd31bcbf302130b81a7499006cb3b8c40f8426fd2f443c90a72fc
Instruction Fuzzy Hash: FA91AFB37106D8C6F750CF65D4903ED2BA0BB69B88F58416DDE6A67A85CA38C4C3C712

Function 000001EF1F224220 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 000001EF1F224240
FreeEnvironmentStringsW.KERNEL32 ref: 000001EF1F22433B
RtlInitUnicodeString.NTDLL ref: 000001EF1F2243AE
RtlInitUnicodeString.NTDLL ref: 000001EF1F2243BB

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: EnvironmentInitStringStringsUnicode$Free
String ID:
API String ID: 2488768755-0
Opcode ID: bb1e13abb34d8db19154faf70e7aa504caeaa5a602b499931474da21c2608b90
Instruction ID: 2fca15d10cd15d428e3c065ecdd68928e5fe21ebf83e91c48a4cfdacb57808d7
Opcode Fuzzy Hash: bb1e13abb34d8db19154faf70e7aa504caeaa5a602b499931474da21c2608b90
Instruction Fuzzy Hash: 68514A33A14BC8C2EB108F16E54039D7760FBA9B94F549229EFA903B95DF78D1E28705

Function 000001EF1F1E0120 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 000001EF1F25A8FC: std::_Lockit::_Lockit.LIBCPMT ref: 000001EF1F25A919
Part of subcall function 000001EF1F25A8FC: std::locale::_Setgloballocale.LIBCPMT ref: 000001EF1F25A93C

std::_Lockit::_Lockit.LIBCPMT ref: 000001EF1F1E0161
std::_Lockit::_Lockit.LIBCPMT ref: 000001EF1F1E0186
std::_Facet_Register.LIBCPMT ref: 000001EF1F1E0232
Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F1E0294

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_RegisterSetgloballocalestd::locale::_
String ID:
API String ID: 3698853521-0
Opcode ID: 7fc3597cd9704a6304594a27bb2dfeeca3e59ce2e728f14c12add50f8541c22a
Instruction ID: 387915e5e6e18bcc7b81337637741376f583a54ea100866f03dd64844d8b13f4
Opcode Fuzzy Hash: 7fc3597cd9704a6304594a27bb2dfeeca3e59ce2e728f14c12add50f8541c22a
Instruction Fuzzy Hash: D0413733211BC8C1EA11DB11E8453DD73A4FBA8B94F54063AEEAE177A6DF38C4828711

Function 000001EF1F230274 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F2302ED
_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F230349
_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F230384
_invalid_parameter_noinfo.LIBCMT ref: 000001EF1F2303A9

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f47f5365830de18e31c9f66efcfcebced3ed900e80df05c2fe820f8996efde49
Instruction ID: eb7935da3ba46b5d48f24fad7a31cfa4b201f499709a5d2026e2ecb03d473bca
Opcode Fuzzy Hash: f47f5365830de18e31c9f66efcfcebced3ed900e80df05c2fe820f8996efde49
Instruction Fuzzy Hash: 5F412EB3505AC8C7E752DF25C4203AC3BA4EB59F48F4980A9CE9D47386DA3D8486C327

Function 000001EF1F2140C0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000001EF1F2140EB
std::_Lockit::_Lockit.LIBCPMT ref: 000001EF1F214110
std::_Facet_Register.LIBCPMT ref: 000001EF1F2141BB
Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F214206

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: f751cf97cbdb91efc437d10692cdb5900781dee89e6afe037389110580d2090b
Instruction ID: 25e516466632bd4159ec20ec2a96e48a57ba5988fe26618677cc5e00e1ca77c9
Opcode Fuzzy Hash: f751cf97cbdb91efc437d10692cdb5900781dee89e6afe037389110580d2090b
Instruction Fuzzy Hash: 2A415B33615AC8C0FA25DB15E8503DD6360FBA9B94F58013AAEAD876A5DE38C4C38712

Function 000001EF1F1E1DD0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000001EF1F1E1DFB
std::_Lockit::_Lockit.LIBCPMT ref: 000001EF1F1E1E20
std::_Facet_Register.LIBCPMT ref: 000001EF1F1E1ECB
Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F1E1F16

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: deae80201b058b93dee9511eb23f4883bce05ec3d16f28b31309998fe1f492bf
Instruction ID: f353ecbad31ade09ea325f2ceee5a8bafaac5b4fc5af56ba8240d3fdafe60e6b
Opcode Fuzzy Hash: deae80201b058b93dee9511eb23f4883bce05ec3d16f28b31309998fe1f492bf
Instruction Fuzzy Hash: 6E416E33205BC8C1EA16DB15E4513DD63A0FBA8B94F580139AEAE677A6DA38C4C39711

Function 000001EF1F214940 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000001EF1F21496B
std::_Lockit::_Lockit.LIBCPMT ref: 000001EF1F214990
std::_Facet_Register.LIBCPMT ref: 000001EF1F214A3B
Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F214A86

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 225fe1b72370eebaf99dac6ca4c61f0c7a8ae1283e1f422937767657019483ac
Instruction ID: 4d7e8992dd209353fd7b113e1b1c435038b38e53a47de530efd658190c2ae464
Opcode Fuzzy Hash: 225fe1b72370eebaf99dac6ca4c61f0c7a8ae1283e1f422937767657019483ac
Instruction Fuzzy Hash: A7418E33215BC8C1EA21DF15E4503DD6360FB69B94F59023AAEAD4B7A5DE38C4C38716

Function 000001EF1F1F39F0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000001EF1F1F3A1B
std::_Lockit::_Lockit.LIBCPMT ref: 000001EF1F1F3A40
std::_Facet_Register.LIBCPMT ref: 000001EF1F1F3AEB
Concurrency::cancel_current_task.LIBCPMT ref: 000001EF1F1F3B36

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 268a738e79390acd07def2dc4d1be91678e0d7bbd421806bae9408622498fc9b
Instruction ID: 1cd6b26e6cce4e13cc158112d61b0a43b8022439d96080342168af750b012ea6
Opcode Fuzzy Hash: 268a738e79390acd07def2dc4d1be91678e0d7bbd421806bae9408622498fc9b
Instruction Fuzzy Hash: E3417C33201AC8C0EA14DB16E4503DD7760FBA8BA4F58023AEE9D577A5DA38C4878701

Function 000001EF1F259BF0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 000001EF1F259520: GetModuleHandleW.KERNEL32 ref: 000001EF1F259536
Part of subcall function 000001EF1F259520: GetProcAddress.KERNEL32 ref: 000001EF1F259546

GetLastError.KERNEL32 ref: 000001EF1F259C14

Part of subcall function 000001EF1F237BC4: IsProcessorFeaturePresent.KERNEL32 ref: 000001EF1F237BEA

GetFileAttributesW.KERNEL32 ref: 000001EF1F259C23
__std_fs_open_handle.LIBCPMT ref: 000001EF1F259C4C
CloseHandle.KERNEL32 ref: 000001EF1F259C5E

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: Handle$AddressAttributesCloseErrorFeatureFileLastModulePresentProcProcessor__std_fs_open_handle
String ID:
API String ID: 156590933-0
Opcode ID: ab22cb6cb8c17ed70bd3674071cc7aa31663a6931c8f4e60418ec3b925b4023f
Instruction ID: 5118a73b1d0525bcba6d377558be6955ca359b47a5f910eb457c3b12ed62cb76
Opcode Fuzzy Hash: ab22cb6cb8c17ed70bd3674071cc7aa31663a6931c8f4e60418ec3b925b4023f
Instruction Fuzzy Hash: C31163733155C8C5EA504B25E0843EE76A1EB6A7B1F14162CAE77466F5DA28C4828E02

Function 000001EF1F1CEAA0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

[json.exception., xrefs: 000001EF1F1CEBDB

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID:
String ID: [json.exception.
API String ID: 0-791563284
Opcode ID: 78a245372a77efb9d66b48e9fa9c4a76d7df65eeb5a9fb1c9e82a4d6fda20a11
Instruction ID: 0952733014105455172ecfe92a9df392d045c6283ed409ec1dc69f3b2ccd399c
Opcode Fuzzy Hash: 78a245372a77efb9d66b48e9fa9c4a76d7df65eeb5a9fb1c9e82a4d6fda20a11
Instruction Fuzzy Hash: AD71B073B10BD885F700CB79E4513DD67A1EBA5B94F644229EE6927B9ADB78C0C28340

Function 000001EF1F214EC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000001EF1F214F2F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000001EF1F214F77

Strings

bad locale name, xrefs: 000001EF1F21504C

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 81129f2ed46ceabdf519319c58bc1d5dd4462a5f530f5aa7f7f79172de3f4dca
Instruction ID: 4d189afa5b0833fe633ed7bf84aaae0d4f0c41c58a1a90f2ae6953a7933182f6
Opcode Fuzzy Hash: 81129f2ed46ceabdf519319c58bc1d5dd4462a5f530f5aa7f7f79172de3f4dca
Instruction Fuzzy Hash: 15512933701AC8C9EB14DFB1D4913EC33A4EF64B48F484039AE69A7A95DA34C596D34A

Function 000001EF1F1F4780 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000001EF1F1F47EF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000001EF1F1F4837

Strings

bad locale name, xrefs: 000001EF1F1F4916

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: c85f5f4d0835978807908d786877568eeda184a6032ef30fff5fd87d8d9f5d51
Instruction ID: 9b1f7bcd4914b042131b9bd758dbc30df084d8df1311dffa08df63e6d9146ec4
Opcode Fuzzy Hash: c85f5f4d0835978807908d786877568eeda184a6032ef30fff5fd87d8d9f5d51
Instruction Fuzzy Hash: 55513633302AC8C9EB14DFA1D4903EC33A4EF64B58F444139EE9967A99DA34C5A69305

Function 000001EF1F241068 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001EF1F246448: _invalid_parameter_noinfo.LIBCMT ref: 000001EF1F24647B

_get_daylight.LIBCMT ref: 000001EF1F241180
_get_daylight.LIBCMT ref: 000001EF1F241191

Strings

?, xrefs: 000001EF1F241111

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: ee72351df311ff027eaf8af198dd50b8868fef75caf7a1d708de55c1de70a8ab
Instruction ID: b9e12f755f1e3295d9e51b942c2f576ee7f765ff5201a315aee331b6c85422e0
Opcode Fuzzy Hash: ee72351df311ff027eaf8af198dd50b8868fef75caf7a1d708de55c1de70a8ab
Instruction Fuzzy Hash: E441B9333147C8C6FB659B25E4113AD6690EBB4BA4F24423DEE6946AD5DB78C4C38B02

Function 000001EF1F23AF20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001EF1F23B037
GetLastError.KERNEL32 ref: 000001EF1F23B059

Strings

U, xrefs: 000001EF1F23AFE3

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 95c1b5a9b453dd21b53d1d3abd175e481a437f6821d85bbfa209bab1ceee3d57
Instruction ID: 2bc7fa2a2504db5ca34e0a45eeb117517754a2b846a07ccce12fbc243fdf3980
Opcode Fuzzy Hash: 95c1b5a9b453dd21b53d1d3abd175e481a437f6821d85bbfa209bab1ceee3d57
Instruction Fuzzy Hash: 00418E73715AC8C6DB208F65E4443EE67A0FBA8784F944139EE9D87B94DB78C482CB41

Function 000001EF1F24F198 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 000001EF1F24F1E8
RaiseException.KERNEL32 ref: 000001EF1F24F229

Strings

csm, xrefs: 000001EF1F24F216

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4d2c4101b9d2858735cfea5a09a2e9289d44dfdbc7b24173af3d04f9105eea82
Instruction ID: 51bdf90be36677ee0490e600bc7d5f6d784d6367bec3ca413282e660b46808fc
Opcode Fuzzy Hash: 4d2c4101b9d2858735cfea5a09a2e9289d44dfdbc7b24173af3d04f9105eea82
Instruction Fuzzy Hash: 59112B33214BC882EB218B15F44429E77E4FBA9B94F584225DF9D07BA8DF78C592CB00

Function 000001EF1F24D260 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 000001EF1F24D270

Strings

kernel32.dll, xrefs: 000001EF1F2724F1

Memory Dump Source

Source File: 00000000.00000002.1491364667.000001EF1F1A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF1F1A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef1f1a0000_unique.jbxd

Yara matches

Similarity

API ID: AcquireExclusiveLock
String ID: kernel32.dll
API String ID: 4021432409-1793498882
Opcode ID: 48109a9d1cf83396031941df6aeb8639c1bea2b67534f88997658316a4ae9db1
Instruction ID: 82c2d6b5b11480b74b7de202969997202a8bbf63e5feefe14d01761682f96ca0
Opcode Fuzzy Hash: 48109a9d1cf83396031941df6aeb8639c1bea2b67534f88997658316a4ae9db1
Instruction Fuzzy Hash: 3501FB732009C8C2EB518B15E86479D33A0EB36B64F805329CD39522E4DB3A89C6DB02

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report unique.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

DNS Queries

Windows Analysis Report
unique.exe

Function 000001EF1F21FB30 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 225
windowCOMMON

Function 000001EF1F2598C0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Function 000001EF1F1DB820 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 862
libraryloaderCOMMON

Function 000001EF1F216480 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173
synchronizationCOMMON

Function 000001EF1F24114C Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Function 000001EF1F21F200 Relevance: 13.9, APIs: 9, Instructions: 408
networkfileCOMMON

Function 000001EF1F25E968 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Function 000001EF1F218F60 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 451
fileCOMMON

Function 000001EF1F2413C8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMONLIBRARYCODE

Function 000001EF1F23749C Relevance: 9.2, APIs: 6, Instructions: 227
COMMON

Function 000001EF1F228B70 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410
COMMON

Function 000001EF1F218B30 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 194
windowCOMMON

Function 000001EF1F219BE0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 250
networkCOMMON

Function 000001EF1F223B30 Relevance: 13.6, APIs: 9, Instructions: 117
COMMON

Function 000001EF1F23D5F0 Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre